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PREFACE 


VAX is a family of upward-compatible computer systems. It is a natural outgrowth of and is 
strongly compatible with the PDP-11 family. We believe that these systems represent a significant 
departure from traditional methods of computer design. VAX represents the culmination of years 
of analysis of the needs of software, and compilers in particular. 


For readers interested in just a summary of the family, please refer to the VAX Technical Summary. 
This manual explains the machine language programming and operation of any member of the 
VAX family, for both instructional and reference purposes. Basically the manual defines in detail 
how the central processor functions, exactly what its instructions do, how it handles data, what 
its control and status information means, and what programming techniques and procedures must 
be employed to utilize it effectively. The programming is given in machine language, in that it 
uses only the basic instruction mnemonics and symbolic addressing defined by the assembler. 
The treatment relies neither on any other Digital software nor on any of the more sophisticated 
features of the assembler. Moreover, the manual is completely self-contained -- no prior Knowledge 
of the assembler is required. 


The text of the manual is devoted almost entirely to functional description and programming. 
Chapter 1 discusses the goals of the system and the notational conventions used throughout the 
manual. Chapter 2 defines the formats of the various forms of data and instructions. Chapter 3 
discusses the addressing modes used in instructions. Chapter 4 gives the definition and detailed 
description of all instructions generally available to users of the system. Chapter 5 defines the 
memory management aspects of the system. Chapter 6 discusses the interrupt and exception 
handling in the system. Chapter 7 covers process structure and context switching. Chapter 8 
defines those interactions between processor, memory, and I/O devices which are true of any 
member of the family. Chapter 9 defines the specifics of interacting with processor registers. 
Chapter 10 documents the PDP-11 Compatibility Mode of operation. Chapter 11 discusses system 
bootstrapping and console operation. Appendix A is a summary of the instructions, their operands, 
and the encoding. It is suitable to be used to construct an "instruction card". Appendix B defines 
the rules for subsetting instructions in various implementations of the VAX family. 
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CHAPTER 1 


INTRODUCTION 


1.1 DESIGN GOALS 


VAX represents a significant extension of the PDP-11 family architecture. It shares with the PDP-11 byte 
addressing, similar I/O and interrupt structures, and identical data formats. Although the instruction set is 
not strictly compatible with the PDP-11, it is related, and can be mastered easily by a PDP-11 programmer. 
Likewise the similarity enables straightforward manual conversion of existing PDP-11 programs to VAX. 
Existing user mode PDP-11 programs which do not need the extended features of VAX can run unchanged 
in the PDP-11 compatibility mode provided in VAX. 


As compared to the PDP-11, VAX offers a greatly extended virtual address space, additional instructions 
and data types, and new addressing modes. Also provided is a sophisticated memory management and 
protection mechanism, and hardware assisted process scheduling and synchronization. 


A number of specific goals guided the VAX design: 


Maximal compatibility with the PDP-11 consistent with a significant extension of the virtual 
address space, and a significant functional enhancement. 


High bit efficiency. This is achieved by a wide range of data types and new addressing modes. 
PDP-11 programs naively translated to VAX should not grow significantly in size; while programs 
redesigned to exploit VAX should get smaller despite the extended virtual address space. 


A systematic, elegant instruction set with orthogonality of operators, data types, and addressing 
modes. This enables the instruction set to be exploited easily, particularly by high level language 
processors. 


Extensibility. The instruction set is designed so that new data types and operators can be 
included efficiently in a manner consistent with the currently defined operators and data types. 


Range. The architecture should be suitable over the entire range of PDP-11 computer system 
implementations currently sold by Digital Equipment Corporation. 


The VAX Architecture Reference Manual describes the architecture of VAX and applies to all implementations 
of VAX systems. Subsets of the VAX architecture are described in Appendix B. 
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1.2 TERMINOLOGY AND CONVENTIONS 


1.2.1 Numbering 


All numbers unless otherwise indicated are decimal. Where there is ambiguity, numbers other than decimal 
are indicated with the base in English following the number in parentheses (e.g., FF (hex)). 


1.2.2 UNPREDICTABLE And UNDEFINED 


Results specified as UNPREDICTABLE may vary from moment to moment, implementation to implementation, 
and instruction to instruction within implementations. Software can never depend on results specified as 
UNPREDICTABLE. Operations specified as UNDEFINED may vary from moment to moment, implementation 
to implementation, and instruction to instruction within implementations. The operation may vary in effect 
from nothing to stopping system operation. UNDEFINED operations must not cause the processor to hang 
i.e. reach an unhalted state from which there is no transition to a normal state in which the machine 
executes instructions. Note the distinction between result and operation. Non-privileged software can not 
invoke UNDEFINED operations. 


1.2.3 Ranges And Extents 


Ranges are specified in English and are inclusive (e.g., a range of integers 0 through 4 includes the integers 
0, 1, 2, 3, and 4.) Extents are specified by a pair of numbers separated by a colon and are inclusive (i.e. 
bits 7:3 specifies an extent of bits including bits 7, 6, 5, 4, and 3). 


1.2.4 MBZ 


Fields specified as MBZ (Must Be Zero) should never be filled by software with a non-zero value. If the 
processor encounters a non-zero value in a field specified as MBZ, a reserved operand fault or abort occurs 
(see Chapter 6, Exceptions and Interrupts) if that field is accessible to non-privileged software. MBZ fields 
that are accessible only to privileged software (kernel mode) may not be checked for non-zero value by 
some or all VAX implementations. Non-zero values in MBZ fields accessible only to privileged software may 
produce UNDEFINED operation. 


INTRODUCTION 3 
Terminology and Conventions 


1.2.5 Reserved 
Unassigned values of fields are reserved for future use. In many cases, some values are indicated as 
reserved to CSS/customers. Only these values should be used for non-standard applications. The values 


indicated as reserved to DEC and all MBZ fields are to be used only to extend the standard architecture 
in the future. 


1.2.6 Figure Drawing Conventions 


Figures which depict registers or memory follow the convention that increasing addresses run right to left 
and top to bottom. 


[End of Chapter 1] 
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CHAPTER 2 


BASIC ARCHITECTURE 


2.1 ADDRESSING 


The basic addressable unit in VAX is the 8-bit byte. Virtual addresses are 32 bits long: hence the virtual 
address space is 2**32 (approximately 4.3 billion) bytes. Virtual addresses as seen by the program are 
translated into physical memory addresses by the memory management mechanism described in Chapter 
5. 


2.2 DATA TYPES 


2.2.1 Byte 


A byte is 8 contiguous bits starting on an addressable byte boundary. The bits are numbered from the right 
0 through 7: 


7 0 


A byte is specified by its address A. When interpreted arithmetically, a byte is a twos complement integer 
with bits of increasing significance going O through 6 and bit 7 the sign bit. The value of the integer is in 
the range -128 through 127. For the purposes of addition, subtraction, and comparison, VAX instructions 
also provide direct support for the interpretation of a byte as an unsigned integer with bits of increasing 
significance going O through 7. The value of the unsigned integer is in the range O through 255. 
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Data Types 


2.2.2 Word 


A word is 2 contiguous bytes starting on an arbitrary byte boundary. The bits are numbered from the right 
O through 15: 


1 
5 0 


A word is specified by its address A, the address of the byte containing bit 0. When interpreted arithmetically, 
a word is a twos complement integer with bits of increasing significance going O through 14 and bit 15 
the sign bit. The value of the integer is in the range -32,768 through 32,767. For the purposes of addition, 
subtraction and comparison, VAX instructions also provide direct support for the interpretation of a word as 
an unsigned integer with bits of increasing significance going 0 through 15. The value of the unsigned 
integer is in the range O through 65,535. 


2.2.3 Longword 


A longword is 4 contiguous bytes starting on an arbitrary byte boundary. The bits are numbered from the 
right O through 31: 


3 
1 0 


A longword is specified by its address A, the address of the byte containing bit 0. When interpreted 
arithmetically, a longword is a twos complement integer with bits of increasing significance going O through 
30 and bit 31 the sign bit. The value of the integer is in the range -2,147,483,648 through 2,147,483,647. 
For the purposes of addition, subtraction, and comparison, VAX instructions also provide direct support for 
the interpretation of a longword as an unsigned integer with bits of increasing significance going O through 
31. The value of the unsigned integer is in the range O through 4,294,967,295. 


2.2.4 Quadword 


A quadword is 8 contiguous bytes starting on an arbitrary byte boundary. The bits are numbered from the 
right O through 63: 
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Data Types 
3 
1 0) 
7A 
:At+4 
6 3 
3 2 


A quadword is specified by its address A, the address of the byte containing bit 0. When interpreted 
arithmetically, a quadword is a twos complement integer with bits of increasing significance going O through 
62 and bit 63 the sign bit. The value of the integer is in the range -2**63 to 2**63-1. The quadword data 
type is not fully supported by VAX instructions. 


2.2.5 Octaword 


A octaword is 16 contiguous bytes starting on an arbitrary byte boundary. The bits are numbered from the 
right O through 127: 


3 

1 0 
:A 
>At+4 
:At+8 
-A+12 

1 9 

2 6 

7 


A octaword is specified by its address A, the address of the byte containing bit 0. When interpreted 
arithmetically, a octaword is a twos complement integer with bits of increasing significance going O through 
126 and bit 127 the sign bit. The value of the integer is in the range -2**127 to 2**127-1. The octaword 
data type is not fully supported by VAX instructions. 


2.2.6 F_floating 


A F_floating datum is 4 contiguous bytes starting on an arbitrary byte boundary. The bits are labelled from 
the right O through 31. 
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s exp fraction a 


A F_floating datum is specified by its address A, the address of the byte containing bit 0. The form of a 
F_floating datum is sign magnitude with bit 15 the sign bit, bits 14:7 an excess 128 binary exponent, and 
bits 6:0 and 31:16 a normalized 24-bit fraction with the redundant most significant fraction bit not represented. 
Within the fraction, bits of increasing significance go from 16 through 31 and 0 through 6. The 8-bit exponent 
field encodes the values 0 through 255. An exponent value of O together with a sign bit of 0, is taken to 
indicate that the F_floating datum has a value of 0. Exponent values of 1 through 255 indicate true binary 
exponents of -127 through +127. An exponent value of 0, together with a sign bit of 1, is taken as reserved. 
Floating point instructions processing a reserved operand take a reserved operand fault (See Chapter 4 and 
6). The value of a F_floating datum is in the approximate range .29*10**-38 through 1.7*10**38. The 
precision of a F_floating datum is approximately one part in 2**23, i.e., typically 7 decimal digits. 


2.2.7 D_floating 


A D_floating datum is 8 contiguous bytes starting on an arbitrary byte boundary. The bits are labelled from 
the right O through 63: 


1 i 
5 4 7 6 O 
[= [sam |. 


A D_floating datum is specified by its address A, the address of the byte containing bit 0. The form of a 
D_floating datum is identical to a floating datum except for an additional 32 low significance fraction bits. 
Within the fraction, bits of increasing significance go 48 through 63, 32 through 47, 16 through 31, and 0 
through 6. The exponent conventions, and approximate range of values is the same for D_floating as 
F_ floating. The precision of a D_floating datum is approximately one part in 2**55, t.e., typically 16 decimal 
digits. 


2.2.8 G_floating 


A G_floating datum is 8 contiguous bytes starting on an arbitrary byte boundary. The bits are labelled from 
the right 0 through 63: 
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4 3 0 


iL [=a]. 


A G_floating datum is specified by its address A, the address of the byte containing bit 0. The form of a 
G_floating datum is sign magnitude with bit 15 the sign bit, bits 14:4 an excess 1024 binary exponent, and 
bits 3:0 and 63:16 a normalized 53-bit fraction with the redundant most significant fraction bit not represented. 
Within the fraction, bits of increasing significance go 48 through 63, 32 through 47, 16 through 31, and 0 
through 3. The 11-bit exponent field encodes the values 0 through 2047. An exponent value of 0 together 
with a sign bit of 0, is taken to indicate that the G_floating datum has a value of 0. Exponent values of 
1 through 2047 indicate true binary exponents of -1023 through +1023. An exponent value of 0, together 
with a sign bit of 1, is taken as reserved. Floating point instructions processing a reserved operand take a 
reserved operand fault (See Chapter 4 and 6). The value of a G_floating datum is in the approximate range 
.56*10* *-308 through .9*10**308. The precision of a G_floating datum is approximately one part in 2**52, 
i.e., typically 15 decimal digits. 


on 
> 


2.2.9 H_floating 


A H_floating datum is 16 contiguous bytes starting on an arbitrary byte boundary. The bits are labelled 
from the right 0 through 127: 


1 1 
5 4 0 
a 


A H_floating datum is specified by its address A, the address of the byte containing bit 0. The form of a 
H_ floating datum is sign magnitude with bit 15 the sign bit, bits 14:0 an excess 16384 binary exponent, 
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and bits 127:16 a normalized 113-bit fraction with the redundant most significant fraction bit not represented. 
Within the fraction, bits of increasing significance go 112 through 127, 96 through 111, 80 through 95, 64 
through 79,48 through 63, 32 through 47, and 16 through 31. The 15-bit exponent field encodes the values 
QO through 32767. An exponent value of O together with a sign bit of 0, is taken to indicate that the 
H_ floating datum has a value of 0. Exponent values of 1 through 32767 indicate true binary exponents of 
-16383 through +16383. An exponent value of 0, together with a sign bit of 1, is taken as reserved. 
Floating point instructions processing a reserved operand take a reserved operand fault (See Chapter 4 and 
6). The value of a H_floating datum is in the approximate range .84*10**-4932 through .59*10* *4932. 
The precision of a H_floating datum is approximately one part in 2**112, i.e., typically 33 decimal digits. 


2.2.10 Variable Length Bit Field 


A variable bit field is 0 to 32 contiguous bits located arbitrarily with respect to byte boundaries. A variable 
bit field is specified by 3 attributes: the address A of a byte, a bit position P which is the starting location 
of the field with respect to bit O of the byte at A, and a size S of the field. The specification of a bit field 
is indicated by the following where the field is the shaded area. 


P+S P+S-1i P P-1 0 
S-i 0 


For bit strings in memory, the position is in the range -2**31 through 2**31-1 and is conveniently viewed 
as a signed 29-bit byte offset and a 3-bit bit-within-byte field: 


3 
1 3 2 0) 


byte offset bwb 


The sign extended 29-bit byte offset is added to the address A and the resulting address specifies the byte 
in which the field begins. The 3-bit bit-within-byte field encodes the starting position (O through 7) of the 
field within that byte. The VAX field instructions provide direct support for the interpretation of a field as a 
signed or unsigned integer. When interpreted as a signed integer, it is twos complement with bits of 
increasing significance going 0 through S-2; bit S-1 is the sign bit. When interpreted as an unsigned integer, 
bits of increasing significance go from 0 to S-1. A field of size 0 has a value identically equal to 0. 


A variable bit field may be contained in 1 to 5 bytes. From a memory management point of view (Chapter 
5) only the minimum number of aligned longwords necessary to contain the field may be actually referenced. 


For bit fields in registers, the position is in the range O through 31. The position operand specifies the 
starting position (0 through 31) of the field in the register. A variable bit field may be contained in 2 registers 
if the sum of position and size exceeds 32. 
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P+S P+S-1 


For further details on the specification of variable length bit fields see Chapter 4. 


2.2.11 Character String 
A character string is a contiguous sequence of bytes in memory. A character string is specified by 2 


attributes: the address A of the first byte of the string, and the length L of the string in bytes. Thus the 
format of a character string is: 


:A+L-1 


7 ) 
7 0 


The address of a string specifies the first character of a string. Thus "XYZ" is represented: 


The length L of a String is in the range O through 65,535. 
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2.2.12 Trailing Numeric String 


A trailing numeric string is a contiguous sequence of bytes in memory. The string is specified by 2 attributes 
: the address A of the first byte (most significant digit) of the string, and the length L of the string in bytes. 


All bytes of a trailing numeric string, except the least significant digit byte, must contain an ASCII decimal 
digit character (0-9). The representation for the high order digits is: 


digit decimal hex ASCII character 
0 48 30 0 
1 49 31 1 
2 50 32 2 
3 51 33 3 
4 52 34 4 
5 53 35 5 
6 54 36 6 
7 55 37 7 
8 56 38 8 
9 57 39 9 


The highest addressed byte of a trailing numeric string represents an encoding of both the least significant 
digit and the sign of the numeric string. The VAX numeric string instructions support any encoding; however 
there are 3 preferred encodings used by DEC software. These are (1) unsigned numeric in which there js 
no sign and the least significant digit contains an ASCII decimal digit character, (2) zoned numeric, and &b 
overpunched numeric. Because the overpunch format has been used by compilers of many manufacturers 
over many years, and because various card encodings are used, several variations in overpunch format 
have evolved. Typically, these alternate forms are accepted on input; the normal form is generated as the 
output for all operations. The valid representations of the digit and sign in each of the later two formats 
is: 
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Representation of Least Significant Digit and Sign 


Zoned Numeric Format Overpunch Format 
digit | decimal hex ASCII | decimal hex ASCII char 
| char | norm alt. 
0 | 48 30 0 | 123 7B { Oo[{ ? 
1 | 49 31 1 | 65 41 A 1 
2 | 50 32 2 | 66 42 B 2 
3 | 51 33 3 | 67 43 C 3 
4 | 52 34 4 | 68 44 D 4 
5 | 53 35 5 | 69 45 E 5 
6 | 54 36 6 | 70 46 F 6 
7 | 55 37 7 | 71 47] G 7 
8 | 56 38 8 | 72 48 H 8 
9 | 57 39 9 | 73 49 I 9 
-0 | 112 70 p | 125 7D } J} !: 
-1 | 113 71 q | 74 4A J 
-2 | 114 72 r | 75 4B K 
-3 | 115 73 s | 76 4C L 
—4 | 116 74 t | ca | 4D M 
=5 | 117 75 u | 78 4E N 
-6 | 118 76 V | 19 4F O 
-7 | 119 77 W | 80 50 P 
-8 | 120 78 x | 81 51 @) 
-9 | 121 79 y | 82 52 R 


The length L of a trailing numeric string must be in the range 0 to 31 (0 to 31 digits). The value of a 0 
length string is identically 0. 


The address A of the string specifies the byte of the string containing the most significant digit. Digits of 
decreasing significance are assigned to increasing addresses. Thus "123" is represented: 
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Zoned Format or Unsigned Overpunch Format 
7 4 3 0 7 4 3 0 
> A eae 
A+1 A+1 
A+2 A+2 
and "-123" is represented : 
Zoned Format 
na ae 
: Ati A+1 
>: At+2 A+2 


2.2.13 Leading Separate Numeric String 


A leading separate numeric string is a contiguous sequence of bytes in memory. A leading separate numeric 
String is specified by 2 attributes: the address A of the first byte (containing the sign character), and a 
length L, which is the length of the string in digits and NOT the length of the string in bytes. The number 
of bytes in a leading separate numeric string is L+1. 


The sign of a separate leading numeric string is stored in a separate byte. Valid sign bytes are: 


Sign decimal hex ASCII character 
+ 43 2B + 
+ 32 20 <blank> 
7 45 2D - 


The preferred representation for "+" is ASCII "+". All subsequent bytes contain an ASCII digit character: 
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digit decimal hex ASCII character 
0 48 30 0 
1 49 31 1 
2 50 32 2 
3 51 33 3 
4 52 34 4 
5 53 35 5 
6 54 36 6 
7 55 37 7 
8 56 38 8 
9 57 39 9 


The length L of a leading separate numeric string must be in the range 0 to 31 (0 to 31 digits). The value 
of a 0 length string is identically 0O. 


The address A of the string specifies the byte of the string containing the sign. Digits of decreasing 
significance are assigned to bytes of increasing addresses. Thus "+123" is: 


and "-123" is: 
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2.2.14 Packed Decimal String 


A packed decimal string is a contiguous sequence of bytes in memory. A packed decimal string is specified 
by 2 attributes: the address A of the first byte of the string and a length L which is the number of digits 
in the string and NOT the length of the string in bytes. The bytes of a packed decimal string are divided 
into 2 4-bit fields (nibbles) which must contain decimal digits except the low nibble (bits 3:0) of the last 
(highest addressed) byte which must contain a sign. The representation for the digits and sign is: 


digit or sign decimal hex 


WONNHNOHWNEF O 
WONHN OH WNE- O 


10,12,14 or 15 A,C,E, or F 
11 or 13 B, or D 


LP toOdONKHDONPWNE O 


The preferred sign representation is 12 for "+" and 13 for "-". The length L is the number of digits in the 
packed decimal string (not counting the sign) and must be in the range O through 31. When the number 
of digits is odd, the digits and the sign fit in L/2 (integer part only) + 1 bytes. When the number of digits 
is even, it is required that an extra "O" digit appear in the high nibble (bits 7:4) of the first byte of the 
string. Again the length in bytes of the string is L/2 + 1. 


The address A of the string specifies the byte of the string containing the most significant digit in its high 
nibble. Digits of decreasing significance are assigned to increasing byte addresses and from high nibble to 
low nibble within a byte. Thus "+123" has length 3 and is represented: 
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2.3 PROCESSOR STATE 


The processor state consists of that portion of a process’s state which, while the process is executing, is 
stored in processor registers rather than memory. The processor state includes the following: 


e 16 32-bit general purpose registers denoted Rn or R[n], where n is in the range O through 
15, 

e a 32-bit processor status longword (PSL), 

e Privileged internal processor registers (IPR). 


2.3.1 General Purpose Registers 

The general purpose registers are used for temporary storage, accumulators, index registers, and base 
registers. A register containing an address is termed a base register. A register containing an address offset 
(in multiples of operand size, see Chapter 3) is termed an index register. 


The bits of a register are numbered from the right 0 through 31: 


1 0 


Certain of the registers are assigned special meaning by the VAX architecture: 


° R15 is the program counter (PC). PC contains the address of the next instruction byte of the 
program. 

e R14 is the stack pointer (SP). SP contains the address of the top of the processor defined 
stack. 


e R13 is the current frame pointer (FP). The VAX procedure call convention (see VAX/VMS Run 
Time Library Reference Manual) builds a data structure on the stack called a stack frame. FP 
contains the address of the base of this data structure. 


° Ri2 is the argument pointer (AP). The VAX procedure call convention uses a data structure 
termed an argument list. AP contains the address of the base of this data structure. 


Note that these registers are all used as base registers. The assignment of special meaning to these registers 
does not generally preclude their use for other purposes. However, as will be seen in Chapter 3, PC cannot 
be used as an accumulator, temporary, or index register. 
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When a datum of type byte, word, longword, or F_floating is stored in a register, the bit numbering in the 
register corresponds to the numbering in memory. Hence a byte is stored in register bits 7:0, a word in 
register bits 15:0, and longword or F_floating, in register bits 31:0. A byte or word written to a register 
writes only bits 7:0 and 15:0 respectively; the other bits are unaffected. A byte or word read from a register 
reads only bits 7:0 and 15:0 respectively; the other bits are ignored. 


When a quadword, D_floating or G_floating datum is stored in a register Rin], it is actually stored in 2 
adjacent registers R[n] and R{[n+1]. Because of restrictions on the specification of PC (see Chapter 3) 
wraparound from PC to RO is UNPREDICTABLE. Bits 31:0 of the datum are stored in bits 31:0 of register 
R[n] and bits 63:32 of the datum are stored in bits 31:0 of register R[n+ 1]. 


When an octaword or a H_floating datum is stored in register R[n], it is actually stored in adjacent registers 
R[n], R[n+1], R[n+2], and R[n+3]. Because of restrictions on the specification of PC (see Chapter 3) 
wraparound from PC to RO is UNPREDICTABLE. Bits 31:0 of the datum are stored in bits 31:0 of register 
R[n], bits 63:32 in bits 31:0 of register R[n+ 1], bits 95:64 in bits 31:0 of register R[n+2], and bits 127:96 
in bits 31:0 of register R[n +3]. 


With one restriction, a variable length bit field may be specified in the registers: the starting bit position P 
must be in the range 0 through 31. As for quadword, D_floating, and G_floating, a pair of registers R[n] 
and R[n+1] is treated as a 64-bit register with bits 31:0 in register R{[n] and bit 63:32 in register R[n+ 1]. 


None of the string data types stored in registers can be processed by the VAX string instructions. Thus 
there is no architectural specification of the representation of strings in registers. 


2.3.2 Processor Status Longword 


The Processor Status Longword (PSL) is a longword consisting of a word of privileged processor status 
concatenated with the Processor Status Word (PSW). The processor status word (PSW) contains the condition 
codes which give information on the results produced by previous instructions and the exception enables 
which control the processor action on certain exception conditions (see Chapter 6). The condition codes are 
UNPREDICTABLE when they are affected by UNPREDICTABLE results. The VAX procedure call instructions 
(See Chapter 4) conditionally set the IV and DV enables, clear the FU enable, and leave the T enable 
unchanged at procedure entry. 


The PSL is automatically saved on the stack when an exception or interrupt occurs and is saved in the 
Process Control Block on a process context switch (see Chapter 7). The PSL can also be read by the 
MOVPSL instruction (see Chapter 4). 


Bits <31:16> of the PSL can be changed explicitly only by executing a return from exception or interrupt 
instruction (REI). Bits <20:16> can also be changed by an MTPR instruction to the IPL processor register. 
For more details, see Chapter 6. 
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33222222222 2 1 i 
109876543210 6 5 876543210 
UR|PRV T V 
OD; MOD IPL 
eS ee Ses SO ee 


Processor Status Longword 


At bootstrap time, PSL is cleared except for IPL and IS. 


Bits Description 


0 Carry (C). When set, the C (carry) condition code bit indicates the last instruction which affected 
C had a carry out of the most significant bit of the result or a borrow into the most significant 
bit. When C is clear, there was no carry or borrow. 


1 Overflow (V). When set, the V (overflow) condition code bit indicates that the last instruction 
which affected V produced a result whose magnitude was too large to be properly represented 
in the operand which received the result or there was a conversion error. When V is clear, 
there was no overflow or conversion error. 


2 Zero (Z). When set, the Z (zero) condition code indicates that the last instruction which affected 
Z produced a result which was 0. When Z is clear, the result was non-zero. 


3 Negative (N). When set, the N (negative) condition code bit indicates that the last instruction 
which affected N produced a result which was negative. When N is clear, the result was positive 
(or zero). 

4 Trace enable (T). When set at the beginning of an instruction, causes TP to be set. When TP 


is set at the end of an instruction, a trace fault is taken before the execution of the next 
instruction. When TP is clear, no trace exception occurs. Most programs should treat T as 
UNPREDICTABLE because it is set by debuggers and trace programs for tracing and for 
proceeding from a breakpoint. 


5 Integer Overflow trap enable (IV). When set, forces an integer overflow trap after execution of 
an instruction that produced an integer result that overflowed or had a conversion error. When 
IV is clear, no integer overflow trap occurs. (However, the condition code V bit is still set.) 


6 Floating Underflow exception enable (FU). When set, forces a floating underflow exception after 
execution of the instruction that produced an underflowed result (i.e., a result exponent, after 
normalization and rounding, less than the smallest representable exponent for the data type). 
When FU is clear, no exception occurs. On VAX-11/780’s prior to hardware revision 7, a trap 
occurs; on all other VAX processors a fault occurs. 


15:8 


20:16 


21 


22:23 


25:24 


26 


27 


29:28 


30 


31 
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Decimal Overflow trap enable (DV). When set, forces a decimal overflow trap after execution 
of an instruction that produced an overflowed decimal (numeric string, or packed decimal) result 
(i.e., nO room to store a non-zero digit) or had a conversion error. When DV is clear, no trap 
occurs. (However, the condition code V bit is still set.) 


Reserved to DIGITAL, must be zero. 

Interrupt Priority Level (IPL). The current processor priority, in the range O to 1F (hex). The 
processor will accept interrupts only on levels greater than the current level. At bootstrap time, 
IPL is initialized to 1F (hex). 

Reserved to DIGITAL, must be zero. 

Previous Access Mode (PRV_MOD). Loaded from current mode by exceptions and CHMx 


instructions, cleared by interrupts, and restored by REI (see Chapter 6). 


Current Access Mode (CUR_MOD). The access mode of the currently executing process, as 
follows: 


O - KERNEL 

1 - EXECUTIVE 
2 - SUPERVISOR 
3 - USER 


Interrupt Stack (IS). When set the processor is executing on the interrupt stack. Any mechanism 
that sets IS also clears current mode and raises IPL above 0. If an REI attempts to restore a 
PSL with [S=1 and non-zero current mode or zero IPL, a reserved operand fault is taken. 
When clear, the processor is executing on the stack specified by current mode. At bootstrap 
time, IS is set. 


First Part Done (FPD). When set, execution of the instruction addressed by PC cannot simply 
be started at the beginning, and must be restarted at some other, implementation specific, point 
in its operation. If FPD is set and the exception or interrupt service routine modifies FPD, the 
general registers, or the saved PSL (except for T or TP), the results of the restarted instruction’s 
execution are UNPREDICTABLE. If a routine sets FPD, the results are also UNPREDICTABLE. 
However, if software is simulating unimplemented instructions, it may make free use of FPD in 
its simulation. If the hardware encounters a reserved instruction with FPD set, a reserved 
instruction fault is taken with the saved PSL<FPD> set. 


Reserved to DIGITAL, must be zero. 


Trace Pending (TP). Forces a trace fault when set at the beginning of any instruction. Set by 
the processor if T is set at the beginning of an instruction. Any exception or interrupt service 
routine clearing TP must also clear T or the tracing of the interrupted instruction, if any, is 
UNPREDICTABLE. 


Compatibility Mode (CM). When set the processor is in PDP-11 compatibility mode (see chapter 
10). When CM is clear, the processor is in native mode. Compatibility mode is not implemented 
in all VAX processors. In-a processor that does not implement compatibility mode, this bit is 
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always clear. 


2.3.2.1 Permanent Exception Enables - 
The processor action on certain exception conditions is not controlled by bits in the PSW. Traps or faults 


always result from these exception conditions. 


2.3.2.1.1 Divide By Zero - A divide by zero trap is forced after the execution of integer, or decimal division 
instruction which has a zero divisor. A fault occurs on a floating division instruction which has a zero divisor. 


2.3.2.1.2 Floating Overflow - A floating overflow fault is forced after the execution of a floating point 
instruction which produced a result too large to be represented in the result operand. 


2.3.3 Internal Processor Registers 


The privileged internal processor register space provides access to many types of CPU control and status 
registers such as the memory management base registers, parts of the PSL, and the multiple stack pointers. 
These registers are explicitly accessible only by the Move to Processor Register (MTPR) and Move from 
Processor Register (MFPR) instructions which require kernel mode privileges. For details, see Chapter 9. 


[End of Chapter 2] 


BLANK 


CHAPTER 3 


INSTRUCTION FORMATS AND ADDRESSING MODES 


3.1 INSTRUCTION FORMAT 


VAX has a variable length instruction format. An instruction specifies an operation and O to 6 operands. An 
operation specifier is termed an opcode. Depending on the instruction the opcode is 1 or 2 bytes long. An 
operand specifier indicates the addressing mode used to access the operand and may be 1 or 2 bytes. An 
operand specifier may be followed by a specifier extension, an address, or immediate data. The format of 
an n operand instruction is: 


opcode 

operand specifier 1 

specifier extension, address, or immediate data 1 (if needed) 
operand specifier 2 


operand specifier n 
specifier extension, address, or immediate data n (if needed) 


3.2 OPCODE FORMATS 


An instruction is specified by the byte address A of its opcode: 


7 0 


The opcode may extend over 2 bytes; the length depends on the contents of the byte at address A. If, 
and only if, the value of the byte is FC (hex) through FF (hex) is the opcode 2 bytes long: 
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3.3 OPERAND SPECIFIERS 


Each instruction takes a specific sequence of operand specifier types. An operand specifier type conceptually 
has two attributes: the access type and the data type. 


The access types include: 


Read - the specified operand is read only. 
Write - the specified operand is written only. 


Modify - the specified operand is read, potentially modified, and written. This is not done under 
a memory interlock. 


Address - the address of the specified operand in the form of a longword is the actual instruction 
operand. The specified operand is not accessed directly although the instruction may 
subsequently use the address to access that operand. 


Variable bit field base address - same as address access type except for register mode. In 
register mode, the field is contained in register n designated by the operand specifier (or 
register n+ 1 concatenated with register n). This access type is a special variant of the address 
access type. 


Branch - no operand is accessed. The operand specifier itself is a branch displacement. 


Types 1 - 5 are termed general mode addressing. Type 6 is termed branch mode addressing. 


The data types include: 


Byte 

Word 

Longword and F_floating which are equivalent for addressing mode considerations. 
Quadword, D_floating, and G_floating which are similarly equivalent. 


Octaword and H_floating which are also similarly equivalent. 


For the address and branch access types which do not directly reference operands, the data type indicates: 


Address - the operand size to be used in the address calculation in autoincrement, 
autodecrement, and index modes. 


Branch - the size of the branch displacement. 
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3.4 NOTATION 


To describe the addressing modes the following is used: 


+ - addition 

= - subtraction 

* - multiplication 
<- - 1S replaced by 


= - 1s defined as 

- concatenation 

Rn or R[n] - the contents of register n 

PC or SP ~ the contents of register 
15 or 14 respectively 


NOTE 


In the formal descriptions of the addressing modes Rn or PC, for example, always 
means the contents of register n or register 15. When there is no ambiguity, Rn 
or PC, for example, is often used in text as the name of register n or register 15. 


(x) - the contents of a location in memory 
whose address is x. 
{ } - arithmetic parentheses used 
to indicate precedence 
SEXT (x) - x is sign extended to size 
of operand needed 
ZEXT (x) - x is zero extended to size 
of operand needed 
OA - operand address 
! - comment delimiter 


Each general mode addressing description includes the definition of the operand address, and the specified 
Operand. For operand specifiers of address access type, the operand address is the actual instruction 
operand; for other access types the specified operand is the instruction operand. The branch mode addressing 
description includes the definition of the branch address. 


3.5 GENERAL MODE ADDRESSING FORMATS 
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3.5.1 Register Mode 


The operand specifier format is: 


No specifier extension follows. 


In register mode addressing the operand is the contents of register n (or register n+1 concatenated with 
register n for quadword, D_floating, and certain field operands): 


operand = Rn !if one register 
or 
REn+1]'Rn !if two registers 
or 
R[n+3]'RUn+2]'REn+1]'Rn !if four registers 


Because registers do not have memory addresses, the operand address is not defined, and register mode 
may not be used for operand specifiers of address access type (except in the case of the base address 
for variable bit field instructions, see Chapter 4). If it is, an illegal addressing mode fault results (See Chapter 
6). PC may not be used in register mode addressing. If PC is read, the value read is UNPREDICTABLE. 
If PC is written, the next instruction executed or the next operand specified is UNPREDICTABLE. Likewise, 
SP may not be used in register mode addressing for an operand which takes two adjacent registers. Again, 
if it is, the results are UNPREDICTABLE in the same fashion. If PC is used in register mode for a write 
access type operand which takes 2 adjacent registers, the contents of RO are UNPREDICTABLE. If R12, 
R13, SP, or PC are used in register mode addressing for an operand which takes four adjacent registers, 
the results are UNPREDICTABLE. If PC is used in register mode for a write access type operand which 
requires 4 adjacent registers, the contents of RO, R1, and R2 are UNPREDICTABLE. Likewise, if R13 is 
used in register mode for a write access type operand which takes 4 adjacent registers, the contents of 
RO are UNPREDICTABLE; and, if SP is used in register mode for a write access type operand which takes 
4 adjacent registers, the contents of RO and R1 are UNPREDICTABLE. 


The assembler notation for register mode is Rn. 


3.5.2 Register Deferred Mode 


The operand specifier format is: 


No specifier extension follows. 


In register deferred mode addressing, the address of the operand is the contents of register n: 
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operand = (OA) 


PC should not be used in register deferred mode addressing. If it is, the address of the operand (and 
whether the operand is written if it is of modify or write access type) is UNPREDICTABLE. 


The assembler notation for register deferred mode is (Rn). 


3.5.3 Autoincrement Mode 


The operand specifier format is: 


No specifier extension follows. If Rn denotes PC, immediate data follows, and the mode is termed immediate 
mode. 


In autoincrement mode addressing, the address of the operand is the contents of register n. After the 
operand address is determined, the size of the operand in bytes (1 for byte; 2 for word; 4 for longword 
and F_floating; 8 for quadword, G_floating and D_floating; and 16 for octaword and H_floating) is added 
to the contents of register n and the contents of register n is replaced by the result: 


Rn <- Rn + size 
operand = (OA) 


Immediate mode may not be used for operands of modify or write access type. If immediate mode is used 
for an operand of modify access type, the value of the data read is UNPREDICTABLE. If immediate mode 
is used for an operand of modify or write access type, the address at which the operand is written (and 
whether it is written) is UNPREDICTABLE. 


The assembler notation for autoincrement mode is (Rn)+. For immediate mode the notation is |*#constant 
where constant is the immediate data which follows. 
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3.5.4 Autoincrement Deferred Mode 


The operand specifier format is: 


No specifier extension follows. If Rn denotes PC, a longword address follows, and the mode is termed 
absolute mode. 


In autoincrement deferred mode addressing, the address of the operand is the contents of a longword whose 
address is the contents of register n. After the operand address is determined, 4 (the size in bytes of a 
longword address) is added to the contents of register n and the contents of register n is replaced by the 
result: 

OA = (Rn) 

Rn <- Rn + 4 

operand = (OA) 


The assembler notation autoincrement deferred mode is @(Rn)+. For absolute mode the notation is 
@#address where address is the longword which follows. 


3.5.5 Autodecrement Mode 


The operand specifier format is: 


No specifier extension follows. 


In autodecrement mode addressing, the size of the operand in bytes (1 for byte; 2 for word; 4 for longword 
and F_ floating; 8 for quadword, G_floating and D_floating; and 16 for octaword, and H _floating) is subtracted 
from the contents of register n and the contents of register n are replaced by the result. The updated 
contents of register n is the address of the operand: 


Rn <- Rn - s1ze 


operand = (OA) 


PC should not be used in autodecrement mode. If it is, the address of the operand (and whether the 
operand is written if it is of modify or write access type) is UNPREDICTABLE and the next instruction 
executed or the next operand specified is UNPREDICTABLE. 
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The assembler notation for autodecrement mode is -(Rn). 


3.5.6 Displacement Mode 


There are 3 operand specifier formats: 


The specifier extension is a signed byte displacement, which follows the operand specifier. This is termed 
byte displacement mode. 


The specifier extension is a signed word displacement, which follows the operand specifier. This is termed 
word displacement mode. 


The specifier extension is a longword displacement, which follows the operand specifier. This is termed 
longword displacement mode. 


In displacement mode addressing, the displacement (after being sign extended to 32 bits if it is byte or 
word) is added to the contents of register n and the result is the operand address: 


OA = Rn + SEXT(displ) !if byte or word displacement 
or 
Rn + displ !if longword displacement 


operand = (OA) 


If Rn denotes PC, the updated contents of PC is used. The updated contents of PC is the address of the 
first byte beyond the specifier extension. 


The assembler notation for byte, word, and long displacement mode is B*D(Rn), W*D(Rn), and L*D(Rn) 
respectively where D = displ. 
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3.5.7 Displacement Deferred Mode 


There are 3 operand specifier formats: 


7 4 3 0 
. fa Te 
The specifier extension is a signed byte displacement, which follows the operand specifier. This is termed 
byte displacement deferred mode. 


The specifier extension is a signed word displacement, which follows the operand specifier. This is termed 
word displacement deferred mode. 


The specifier extension is a longword displacement, which follows the operand specifier. This is termed 
longword displacement deferred mode. 


In displacement deferred mode addressing, the displacement (after being sign extended to 32 bits if it is 
byte or word) is added to the contents of register n and the result is the address of a longword whose 
contents is the operand address: 


OA = (Rn + SEXT(disp1) ) !if byte or word displacement 
or 
(Rn + displ) 'if longword displacement 


operand = (OA) 


If Rn denotes PC, the updated contents of the PC is used. The updated contents of PC is the address of 
the first byte beyond the specifier extension. 


The assembler notation for byte, word, and longword displacement deferred mode is @B*D(Rn), @W*D(Rn), 
and @L*D(Rn) respectively where D = displ. 
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3.5.8 Literal Mode 
The operand specifier format is: 


765 0 


fe [ee 


No specifier extension follows. 


For operands of data type byte, word, longword, quadword, and octaword the operand is the zero extension 
of the 6-bit literal field: 


operand = ZEXT(literal) 
Thus for these data types, literal mode may be used for values in the range O through 63. 


For operands of data type F_floating, D_floating, G_floating, and H_ floating, the 6-bit literal field is composed 
of two 3-bit fields: 


5 3 2 0 


where exp is exponent and fra is fraction. The exp and fra fields are used to form a F_floating or D_floating 
operand as follows: 


where bits 63:32 are not present in a F_floating operand. 
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The exp and fra fields are used to form a G_floating operand as follows: 


se 
5 4 4 3 1 0 


:At+2 


:A+4 


:A+6 


The exp and fra fields are used to form a H_floating operand as follows: 


11 

5 4 0 
o| 16384 + exp 
imp 


:At+2 
:At4 
:A+6 
:A+8 
:A+10 
:A+12 


:A+14 
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The range of values available is given in the following table: 
E E- ==> 
| 
Vv 
0 1 2 3 4 5 6 7 
0 1/2 9/16 5/8 11/16 3/4 13/16 7/8 15/16 
1 41 1 1/8 1 1/4 1 3/8 1 1/2 1 5/8 1 3/4 1 7/8 
2 2 2 1/4 21/2 2 3/4 3 3 1/4 3 1/2 3 3/4 
3 4 4 1/2 5 5: 172 6 6 1/2 7 7 1/2 
4 8 9 10 1l 12 13 14 15 
5 16 18 20 22 24 26 28 30 
6 32 36 40 44 48 52 56 60 
7 64 72 80 88 96 104 112 120 


Table 1. Floating Literals 


Because there is no operand address, literal mode addressing may not be used for operand specifiers of 
address access type. Literal mode addressing may also not be used for operand specifiers of write or modify 
access type. If literal mode is used for operand specifiers of either address, modify, or write access type, 
an illegal addressing mode fault results (see Chapter 6). 


Literal mode addressing is a very efficient way of specifying integer constants in the range 0 to 63 and 
the floating point constants given in Table 1. Literal values outside the indicated range may be obtained 
by autoincrement mode using PC (immediate mode). 


The assembler notation for literal mode is S*#literal. 


3.5.9 Index Mode 


The operand specifier format ts: 


Bits 15:8 contain a second operand specifier (termed the base operand specifier) for any of the addressing 
modes except register, literal or index. The specification of register, literal, or index addressing mode results 
in an illegal addressing mode fault (see Chapter 6). If the base operand specifier requires a specifier 
extension, it immediately follows. The base operand specifier is subject to the same restrictions as would 
apply if it were used alone. If the use of some particular specifier is illegal (i.e., causes a fault or 
UNPREDICTABLE behavior) under some circumstances, then that specifier is similarly illegal as a base 
operand specifier in index mode under the same circumstances. 


The operand to be specified by index mode addressing is termed the primary operand. The base operand 
specifier is used normally to determine an operand address. This address is termed the base operand 
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address (BOA). The address of the primary operand specified is determined by multiplying the contents of 
the index register x by the size of the primary operand in bytes (1 for byte; 2 for word; 4 for longword 
and F_floating; 8 for quadword, D_floating and G_floating; and 16 for octaword, and H_ floating), adding 
BOA, and taking the result: 


OA = BOA + {size * (Rx) } 
operand = (OA) 


If the base operand specifier is for autoincrement or autodecrement mode the increment or decrement size 
is the size in bytes of the primary operand. 


Index mode addressing permits very general and efficient accessing of arrays. The base address of the 
array is determined by the operand address caculation of the base operand specifier. The contents of the 
index register is taken as a logical index into the array. The logical index is converted into a real (byte) 
offset by multiplying the contents of the index register by the size of the primary operand in bytes. 


Certain restrictions are placed on the index register x. PC cannot be used as an index register. If it is, a 
reserved addressing mode fault occurs (see Chapter 6). If the base operand specifier is for an addressing 
mode which results in register modification (i.e. autoincrement mode, autodecrement mode, or autoincrement 
deferred mode), the same register cannot be the index register. If it is, the primary operand address is 
UNPREDICTABLE. 


The names of the addressing modes resulting from index mode addressing are formed by adding the suffix 
"indexed" to the addressing mode of the base operand specifier. The following gives the names and 
assembler notation. The index register is designated Rx to distinguish it from the register Rn in the base 
operand specifier. 

° register deferred indexed - (Rn)[Rx] 

° autoincrement indexed - (Rn) +[Rx] 
or immediate indexed - |*#constant[Rx] which is recognized by the assembler but is not generally useful. 
Note that the operand address is independent of the value of constant. 


° autoincrement deferred indexed - @(Rn) +[Rx] 
or absolute indexed - @#address[Rx] 


e autodecrement indexed - -(Rn)[Rx] 
° byte, word, or longword displacement indexed - B*D(Rn)[Rx],W*D(Rn)[Rx], or L*D(Rn)[Rx] 


e byte, word, or longword displacement deferred indexed - @B*D(Rn)[Rx],@W’D(Rn)[Rx], or 
@L*D(Rn)[Rx] 
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3.6 SUMMARY OF GENERAL MODE ADDRESSING 


3.6.1 General Register Addressing 


7 4 3 0 
Hex Dec Name Assembler rmwav PC SP AP& Index- 
FP able 
0-3 0-3 literal S*#literal yffff - - - £ 
4 4 indexed i[Rx] yyyyy £ y¥ sy f 
5 5 register Rn yyyfy u uq uo f 
6 6 register deferred (Rn) yyyyy u yy y 
7 7 autodecrement -(Rn) yyyyy ues.sy y ux 
8 8 autoincrement (Rn) + yyyyy p yy ux 
9 9 autoincrement 
deferred @(Rn)+ yYyyyyy p yy y ux 
A 10 byte displacement B*D(Rn) Yyyyy p yy y 
B 11 byte displacement 
deferred @B*D(Rn) Yyyyyy p y y y 
C 12 #4word displacement W*D(Rn) YyYyyy p yy y 
D 13 word displacement 
deferred @W*D(Rn) Yyyyy p yy y 
E 14 °&longword displacement L*D(Rn) yyyyy p yy y 
F 15 longword displacement 
deferred @L*D(Rn) yyyyy p yy y 
KEY ; 
D- displacement 
i - any indexable addressing mode 
- - logically impossible 
f - reserved addressing mode fault 
p - Program Counter addressing 
u - UNPREDICTABLE 
uq - UNPREDICTABLE for quad, octa, D floating, G floating, and 


H floating (and field if position + size greater than 32) 
UNPREDICTABLE for octa, and H_floating 

UNPREDICTABLE for index register same as base register 
- yes, always valid addressing mode 

read access 

- modify access 

- write access 

- address access 

- field access 


~ O 
i | 


<omo ze 535nxX cece 
| 
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3.6.2 Program Counter Addressing (reg = 15) 


T 43210 


Hex Dec Name Assembler 
8 8 immmediate I*#constant 
9 9 absolute @#address 
A 10 byte relative B“address 
B 11 byte relative @B“address 

deferred 
C 12 word relative Weaddress 
D 13 word relative @Q@W*address 
deferred 
E 14 long word relative L*address 
F 15 long word relative @L“address 
deferred 
KBY: 
- UNPREDICTABLE 


- yes, always valid addressing mode 
- read access 

modify access 

- write access 

- address access 

- field access 


<n 45 "NCE 


3.7 BRANCH MODE ADDRESSING FORMATS 
There are 2 operand specifier formats: 


7 0 


The operand specifier is a signed byte displacement. 


Hy 
= 
= 
ey 
< 


a i a i 
mM KN NMNMNK GE 


KmRxS SNM NMNNE 


xx KN NMNMNKNK 


MM MK KKK 
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Indexable? 


KS KN NNK< 
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1 
5 0 


; 


The operand specifier is a signed word displacement. 
In branch displacement addressing, the byte or word displacement is sign extended to 32 bits and added 
to the updated contents of PC. The updated contents of PC is the address of the first byte beyond the 
operand specifier. The result is the branch address A: 


A = PC + SEXT(displ) 


The assembler notation for byte and word branch displacement addressing is A where A is the branch 
address. Note that the branch address and not the displacement is used. 


3.8 OPERAND SPECIFIER CONVENTIONS 
The following 3 steps are performed by each instruction: 
° Each operand specifier in order of instruction stream occurrence is treated as follows: 


a. If read access type: evaluate the operand address, 
read the operand, and save it. 


b. If write access type: evaluate the operand address 
and save it. 


c. If modify access type: evaluate the operand 
address and save it; read the operand and save it. 


d. If address access type: evaluate the address and 
Save it. 


e. If branch access type: save the operand specifier. 


e Perform the operation indicated by the instruction. 
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Store the result(s) using the saved addresses in the order indicated by the occurrence of 


operand specifiers in the instruction stream. 


NOTE 


The string (character, numeric, and packed decimal) instructions are an exception 
in that partial results are stored before the instruction operation is completed. The 
variable bit field instructions treat the position, size, and base address operand 
specifiers as the specification of an implied field operand specifier (see Appendix 
A). If multiple exceptions occur, the order in which they are taken is 
UNPREDICTABLE. This can occur, for example, in a floating point instruction whose 
destination operand specifier of write access type uses a reserved addressing mode 
and the operation results in an overflow fault. 


The implications of these conventions are: 


Autoincrement and autodecrement operations occur as the operand specifiers are processed, 
and subsequent operand specifiers use the updated contents of registers modified by those 


operations. 


Other than as indicated above, all input operands are read, and all addresses of output operands 


computed before any results of the instruction are stored. 


An operand of modify access type is not read, modified, and written as an indivisible operation; 
therefore, modify access type operands cannot be used for synchronization. (For synchronization 


instructions, See Chapter 8.) 


If an instruction references two operands of write or modify access type at the same address, 


the first will be overwritten by the second. 


[End of Chapter 3] 
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CHAPTER 4 


INSTRUCTIONS 


4.1 INSTRUCTION SET 

This chapter describes the instructions generally used by all software across all implementations of the VAX 
architecture. Certain instructions which are specific to specialized portions of the VAX architecture (e.g., 
memory management, interrupts and exceptions, process dispatching, and processor registers) and are 


generally used by privileged software are described in the chapters describing those portions of the 
architecture. A concise list of instructions and opcode assignments appears in Appendix A. 


4.1.1 Instruction Descriptions 

The instruction set is divided into the following major sections: 
e Integer arithmetic and logical 
° Address 


e Variable length bit field 


° Control 

e Procedure call 
e Miscellaneous 

° Queue 

e Floating point 

e Character string 


° Cyclic Redundancy Check 


e Decimal string 
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e Edit 
Within each major section, instructions which are closely related are combined into groups and described 
together. The instruction group description is composed of the following: 

° The group name. 

e The format of each instruction in the group. This gives the name and type of each instruction 


operand specifier and the order in which it appears in memory. Operand specifiers from left 
to right appear in increasing memory addresses. 


e The operation of the instruction. 

e The effect on condition codes. 

e Exceptions specific to the instruction. Exceptions which are generally possible for all instructions 
(e.g., illegal or reserved addressing mode, T-bit, memory management violations, etc.) are not 
listed. 

e The opcodes, mnemonics, and names of each instruction in the group. The opcodes are given 
in hex. 

e A description in English of the instruction. 

e Optional notes on the instruction and programming examples. 


4.1.2 Operand Specifier Notation 
Operand specifiers are described in the following way: 


<name>.<access type><data type> 


where: 
e Name is a suggestive name for the operand in the context of the instruction. The name is 
often abbreviated. 
e Access type is a letter denoting the operand specifier access type: 


a - Calculate the effective address of the specified 
operand. Address is returned in a longword 
which is the actual instruction operand. Context 
of address calculation is given by <data type>; 
1.@€. Size to be used in autoincrement, autodecrement, 
and indexing. 
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b - No operand reference. Operand specifier is a 
branch displacement. Size of branch displacement 
is given by <data type>. 

m - Operand is read, potentially modified and written. 
Note that this is NOT an indivisible memory 
operation. Also note that if the operand is not 
actually modified, it may not be written back. 
However, modify type operands are always checked 
for both read and write accessability (See 
Chapter 5). 

r —- Operand is read only. 

v - Calculate the effective address of the specified 
operand. If the effective address 1S in memory, 
the address is returned in a longword 
which is the actual instruction operand. Context 
of address calculation is given by <data type>. 
If the effective address is Rn, the operand is 
in Rn or R[n+1]'Rn. 


w - Operand is written only. 


° Data type is a letter denoting the data type of the operand: 
b - byte 
d - D floating 
f - F floating 
g - G floating 
h - H floating 
1 - longword 
Oo - octaword 
q - quadword 
w - word 
x - first data type specified by instruction 


y - second data type specified by instruction 
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4.1.3 Operation Description Notation 
The operation of each instruction is given as a sequence of control and assignment statements in an 
ALGOL-like syntax. No attempt is made to define the syntax formally, it is assumed to be familiar to the 
reader. The notation used is an extension of that introduced in Chapter 3. 

+ - addition 

- - subtraction, unary minus 


* 


multiplication 

/ - division (quotient only) 

** -— exponentiation 

' - concatenation 

<- - 1S replaced by 

= - is defined as 

Rn or R[n] - contents of register Rn 


PC, SP, FP, or AP - the contents of register R15, R14, R13, 
Or R12 respectively 


PSW - the contents of the processor status word 

PSL - the contents of the processor status long word 

(x) - contents of memory location whose address is x 

(x)+ - contents of memory location whose address is x; 
x incremented by the size of operand referenced 


at x 


-(x) - x decremented by size of operand to be referenced 
at x; contents of memory location whose address is x 


<x:y> - a modifier which delimits an extent from bit 
position x to bit position y inclusive 


<x1,x2,...,xn> - a modifier which enumerates bits xl,x2,...,xn 
{ } - arithmetic parentheses used to indicate precedence 
AND - logical AND 


OR - logical OR 
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XOR - logical XOR 
NOT - logical (ones) complement 
LSS - less than signed 
LSSU - less than unsigned 
LEQ - less than or equal signed 
LEQU - less than or equal unsigned 
EQL - equal signed 
EQLU - equal unsigned 
NEQ - not equal signed 
NEQU - not equal unsigned 
GEQ - greater than or equal signed 
GEQU - greater than or equal unsigned 
GTR - greater than signed 
GTRU - greater than unsigned 


SEXT(x) - x is sign extended to size of operand 
needed 


ZEXT(x) - x is zero extended to size of operand needed 


REM(x,y) - remainder of x divided by y, such that x/y and 
REM(x,y) have the same sign 


MINU(x,y) - minimum unsigned of x and y 


MAXU(x,y) - maximum unsigned of x and y 
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The following conventions are used: 


Other than that caused by ()+, or -(), and the advancement of PC, only operands or portions 
of operands appearing on the left side of assignment statements are affected. 


No operator precedence is assumed, other than that replacement (<-) has the lowest precedence. 
Precedence is indicated explicitly by 


All arithmetic, logical, and relational operators are defined in the context of their operands. 
For example "+" applied to floating operands means a floating add while "+" applied to byte 
operands is an integer byte add. Similarily, "LSS" is a floating comparison when applied to 
floating operands while "LSS" is an integer byte comparison when applied to byte operands. 


Instruction operands are evaluated according to the operand specifier conventions (See Chapter 
3). The order in which operands appear in the instruction description has no effect on the 
order of evaluation. 


Condition codes are in general affected on the value of actual stored results, not on "true" 
results (which might be generated internally to greater precision). Thus, for example, 2 positive 
integers can be added together and the sum stored, because of overflow, as a negative value. 
The condition codes will indicate a negative value even though the "true" result is clearly 
positive. 


4.2 INTEGER ARITHMETIC AND LOGICAL INSTRUCTIONS 


The following instructions are described in this section. 


Add Aligned Word 
ADAW! add.rw, sum.mw 


Add 2 Operand 
ADD{B,W,L}2 add.rx, sum.mx 


Add 3 Operand 
ADD{B,W,L}3 add1.rx, add2.rx, sum.wx 


Add With Carry 
ADWC add.rl, sum.ml 


Arithmetic Shift 
ASH{L,Q} cnt.rb, srce.rx, dst.wx 


Bit Clear 2 Operand 
BIC{B,W,L}2 mask.rx, dst.mx 


Bit Clear 3 Operand 
BIC{B,W,L}3 mask.rx, src.rx, dst.wx 
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Bit Set 2 Operand 
BIS{B,W,L}2 mask.rx, dst.mx 


Bit Set 3 Operand 
BIS{B,W,L}3 mask.rx, srce.rx, dst.wx 


Bit Test 
BIT{B,W,L} mask.rx, src.rx 


Clear 
CLR{B,W,L,Q,O} dst.wx 


Compare 
CMP{B,W,L} src1.rx, src2.rx 


Convert 
CVT{B,W,L}{B,W,L} sre.rx, dst.wy 
All pairs except BB,WW,LL. 


Decrement 
DEC{B,W,L} dif.mx 


Divide 2 Operand 
DIV{B,W,L}2 divr.rx, quo.mx 


Divide 3 Operand 
DIV{B,W,L}3 divr.rx, divd.rx, quo.wx 


Extended Divide 
EDIV divr.rl, divd.rq, quo.wl, rem.wl 


Extended Multiply 


EMUL mulr.rl, muld.rl, add.rl, prod.wq 


Increment 
INC{B,W,L} sum.mx 


Move Complemented 
MCOM{B,W,L} sre.rx, dst.wx 


Move Negated 
MNEG{B,W,L} src.rx, dst.wx 


Move 
MOV{B,W,L,Q} srce.rx, dst.wx 


Move Zero-Extended 
MOVZ{BW,BL,WL} src.rx, dst.wy 


Multiply 2 Operand 
MUL{B,W,L}2 mulr.rx, prod.mx 
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e Multiply 3 Operand 
MUL{B,W,L}3 mulr.rx, muld.rx, prod.wx 


e Push Long 
PUSHL sre.rl, {-(SP).wl} 


e Rotate Long 
ROTL cnt.rb, src.rl, dst.wl 


e Subtract With Carry 
SBWC sub.rl, dif.ml 


e Subtract 2 Operand 
SUB{B,W,L}2 sub.rx, dif.mx 


° Subtract 3 Operand 
SUB{B,W,L}3 sub.rx, min.rx, dif.wx 


e Test 
TST{B,W,L} sre.rx 


° Exclusive OR 2 Operand 
XOR{B,W,L}2 mask.rx, dst.mx 


e Exclusive OR 3 Operand 
XOR{B,W,L}3 mask.rx, src.rx, dst.wx 
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ADAWI Add Aligned Word Interlocked 
Format: 

opcode add.rw, sum.mw 
Operation: 

tmp <- add; 

{set interlock}; 


sum <- sum + tmp; 
{release interlock}: 


Condition Codes: 


<- sum LSS 0; 

<- sum EQL 0; 

<- {integer overflow}; 

<- {carry from most significant bit}; 


ANS 


Exceptions: 


reserved operand fault 
integer overflow 


Opcodes: 


58 ADAWI Add Aligned Word Interlocked 


Description: 


The addend operand is added to the sum operand and the sum operand is replaced by the result. The 
operation is interlocked against similar operations on other processors in a multiprocessor system. The 
destination must be aligned on a word boundary i.e. bit 0 of the address of the sum operand must be 
zero. If it is not, a reserved operand fault is taken. 


Notes: 

e Integer overflow occurs if the input operands to the add have the same sign and the result 
has the opposite sign. On overflow, the sum operand is replaced by the low order bits of the 
true result. 

° If the addend and the sum operands overlap, the result and the condition codes are 


UNPREDICTABLE. 
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ADD Add 
Format: 
opcode add.rx, sum.mx 2 operand 
opcode addl.rx, add2.rx, sum.wx 3 operand 
Operation: 
sum <- sum + add; !2 operand 
sum <- addl + add2; !3 operand 


Condition Codes: 


<- sum LSS 0; 

<- sum EQL 0; 

<- {integer overflow}; 

<- {carry from most significant bit}; 


ASN]! 


Exceptions: 


integer overflow 


Opcodes: 
80 ADDB2 Add Byte 2 Operand 
81 ADDB3 Add Byte 3 Operand 
AO ADDW2 Add Word 2 Operand 
Al ADDW3 Add Word 3 Operand 
CO ADDL2 Add Long 2 Operand 
Cl ADDL3 Add Long 3 Operand 


Description: 

In 2 operand format, the addend operand is added to the sum operand and the sum operand is replaced 
by the result. In 3 operand format, the addend 1 operand is added to the addend 2 operand and the sum 
operand is replaced by the result. 


Notes: 


Integer overflow occurs if the input operands to the add have the same sign and the result has the opposite 
sign. On overflow, the sum operand is replaced by the low order bits of the true result. 
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ADWC Add With Carry 
Format: 

opcode add.rl, sum.ml 
Operation: 

sum <- sum + add + C; 
Condition Codes: 
<- sum LSS 0; 
<- sum EQL 0; 


<- {integer overflow}; 
<- {carry from most significant bit}; 


ASN]! 


Exceptions: 
integer overflow 
Opcodes: 


D8 ADWC Add With Carry 


Description: 


The contents of the condition code C bit and the addend operand are added to the sum operand and the 
sum operand is replaced by the result. 


Notes: 
° On overflow, the sum operand is replaced by the low order bits of the true result. 


e The 2 additions in the operation are performed simultaneously. 
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ASH Arithmetic Shift 
Format: 

opcode cnt.rb, src.rx, dst.wx 
Operation: 

dst <- src shifted cnt bits; 


Condition Codes: 


N <- dst LSS 0; 

Z<- dst EQL 0; 

Vv <- {integer overflow}; 
C.<= .0¢ 


Exceptions: 
integer overflow 
Opcodes: 


78 ASHL Arithmetic Shift Long 
79 ASHQ Arithmetic Shift Quad 


Description: 


The source operand is arithmetically shifted by the number of bits specified by the count operand and the 
destination operand is replaced by the result. The source operand is unaffected. A positive count operand 
shifts to the left bringing Os into the least significant bit. A negative count operand shifts to the right bringing 
in copies of the most signficant (sign) bit into the most significant bit. A 0 count operand replaces the 
destination operand with the unshifted source operand. 


Notes: 


e Integer overflow occurs on a left shift if any bit shifted into the sign bit position differs from 
the sign bit of the source operand. 


e If cnt GTR 32 (ASHL) or cnt GTR 64 (ASHQ) the destination operand is replaced by 0. 


e If cnt LEQ -31 (ASHL) or cnt LEQ -63 (ASHQ) all the bits of the destination operand are 
copies of the sign bit of the source operand. 


INSTRUCTIONS Page 4-13 
Integer Arithmetic and Logical Instructions 


BIC Bit Clear 
Format: 
opcode mask.rx, dst.mx 2 operand 
opcode mask.rx, src.rx, dst.wx 3 operand 
Operation: 
dst <- dst AND {NOT mask}; !2 operand 
dst <- src AND {NOT mask}; !3 operand 


Condition Codes: 


N <- dst LSS 0; 
Z<- dst EQL 0; 
V <- Q; 
CG <= Ce 
Exceptions: 
none 
Opcodes: 


8A BICB2 Bit Clear Byte 
8B BICB3 Bit Clear Byte 
AA BICW2 Bit Clear Word 
AB BICW3 Bit Clear Word 
CA BICL2 Bit Clear Long 
CB BICL3 Bit Clear Long 


Description: 


In 2 operand format, the destination operand is ANDed with the ones complement of the mask operand 
and the destination operand is replaced by the result. In 3 operand format, the source operand is ANDed 
with the ones complement of the mask operand and the destination operand is replaced by the result. 
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BIS Bit Set 
Format: 
opcode mask.rx, dst.mx 2 operand 
opcode mask.rx, src.rx, dst.wx 3 operand 
Operation: 
dst <- dst OR mask; !2 operand 
dst <- src OR mask; !3 operand 


Condition Codes: 


N <- dst LSS 0; 
Z <- dst EQL 0; 
V <- 0: 
CC <= "Cs 
Exceptions: 
none 
Opcodes: 
88 BISB2 Bit Set Byte 2 Operand 
89 BISB3 Bit Set Byte 3 Operand 
A8 BISW2 Bit Set Word 2 Operand 
A9 BISW3 Bit Set Word 3 Operand 
C8 BISL2 Bit Set Long 2 Operand 
C9 BISL3 Bit Set Long 3 Operand 


Description: 


In 2 operand format, the mask operand is ORed with the destination operand and the destination operand 
is replaced by the result. In 3 operand format, the mask operand is ORed with the source operand and 
the destination operand is replaced by the result. 
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BIT Bit Test 
Format: 

opcode mask.rx, src.rx 
Operation: 

tmp <- src AND mask; 


Condition Codes: 


N <- tmp LSS 0; 
Z<- tmp EQL 0; 
V <- QO; 
CG <= 
Exceptions: 
none 
Opcodes: 
93 BITB Bit Test Byte 
B3 BITW Bit Test Word 


D3 BITL Bit Test Long 


Description: 


The mask operand is ANDed with the source operand. Both operands are unaffected. The only action is 
to affect condition codes. 
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CLR Clear 
Format: 

opcode dst.wx 
Operation: 

dst <- Q; 


Condition Codes: 


N <- QO; 
Z<~- Il: 
V <- Q; 
C- <= Cs 
Exceptions: 
none 
Opcodes: 
94 CLRB Clear Byte 
B4 CLRW Clear Word 
D4 CLRL Clear Long 
7C CLRQ Clear Quad 
7CFD CLRO Clear Octa 
Description: 


The destination operand is replaced by 0. 
Notes: 


CLRx dst is equivalent to MOVx S*#0, dst, but is 1 byte shorter. 
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CMP Compare 
Format: 

opcode srcl.rx, src2.rx 
Operation: 

srcl - src2:; 


Condition Codes: 


N <- srcl LSS src2; 
Z<- srcl EQL src2; 
V <- Q> 
C <- srcl LSSU src2; 
Exceptions: 
none 
Opcodes: 


91 CMPB Compare Byte 
Bl CMPW Compare Word 
D1 CMPL Compare Long 


Description: 


The source 1 operand is compared with the source 2 operand. The only action is to affect the condition 
codes. 
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CVT Convert 
Format: 

opcode src.rx, dst.wy 
Operation: 

dst <- conversion of src; 


Condition Codes: 


N <- dst LSS 0; 
Z <- dst EQL 0; 
Vv <- {integer overflow}; 
Cc <- 0; 
Exceptions: 


integer overflow 
Opcodes: 


99 CVTBW Convert Byte to Word 
98 CVTBL Convert Byte to Long 
33 CVTWB Convert Word to Byte 
32 CVTWL Convert Word to Long 
F6 CVTLB Convert Long to Byte 
F7 CVTLW Convert Long to Word 


Description: 

The source operand is converted to the data type of the destination operand and the destination operand 
is replaced by the result. Conversion of a shorter data type to a longer is done by sign extension; conversion 
of longer to a shorter is done by truncation of the higher numbered (most significant) bits. 


Notes: 


Integer overflow occurs if any truncated bits of the source operand are not equal to the sign bit of the 
destination operand. 
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DEC Decrement 
Format: 

opcode dif.mx 
Operation: 

dif <- dif - l: 
Condition Codes: 
<- dif LSS 0; 
<- dif EQL 0; 


<- {integer overflow}; 
<- {borrow into most significant bit}; 


ASWNS 


Exceptions: 


integer overflow 


Opcodes: 
97 DECB Decrement Byte 
B7 DECW Decrement Word 
D7 DECL Decrement Long 
Description: 


One is subtracted from the difference operand and the difference operand is replaced by the result. 
Notes: 


e Integer overflow occurs if the largest negative integer is decremented. On overflow, the 
difference operand is replaced by the largest positive integer. 


° DECx dif is equivalent to SUBx S*#1, dif, but is 1 byte shorter. 
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Format: 


Operation: 


DIV 


opcode 


opcode 


quo <- 


quo <- 


Condition Codes: 


Exceptions: 


Opcodes: 


86 
87 
A6é 
A7 
C6 
C7 


AWNS 


Divide 


divr.rx, quo.mx 


Givr.rx, divd.rx, quo.wx 


quo / divr; 


divd / divr; 


<- quo LSS 0; 
<- quo EQL 0; 
<- {integer overflow} OR {divr EQL 0}; 
<~ OQ; 


integer overflow 


divide by zero 


DIVB2 
DIVB3 
DIVW2 
DIVW3 
DIVL2 
DIVL3 


Description: 


In 2 operand format, the quotient operand is divided by the divisor operand and the quotient operand is 
replaced by the result. In 3 operand format, the dividend operand is divided by the divisor operand and 


Divide 
Divide 
Divide 
Divide 
Divide 
Divide 


Byte 
Byte 
Word 
Word 
Long 
Long 


WN WN W NO 


2 operand 


3 operand 


{2 operand 


!3 operand 


Operand 
Operand 
Operand 
Operand 
Operand 
Operand 


the quotient operand is replaced by the result. 


Notes: 


Division is performed such that the remainder (unless it is zero and which is lost) has the 


same sign as the dividend, t.e., the result is truncated towards 0. 


Integer overflow occurs if and only if the largest negative integer is divided by -1. On overflow, 


operands are affected as in 3 below. 
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° If the divisor operand is 0, then in 2 operand format the quotient operand is not affected; in 
3 operand format the quotient operand is replaced by the dividend operand. 
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EDIV Extended Divide 
Format: 

opcode divr.rl, divd.rq, quo.wl, rem.wl 
Operation: 


quo <- divd / divr; 
rem <- REM(divd, divr); 


Condition Codes: 


N <- quo LSS 0; 

Z <- quo EQL 0; 

V <- {integer overflow} OR {divr EQL 0}; 
C <- 0; 


Exceptions: 


integer overflow 
divide by zero 


Opcodes: 


7B EDIV Extended Divide 


Description: 


The dividend operand is divided by the divisor operand; the quotient operand is replaced by the quotient 
and the remainder operand is replace by the remainder. 


Notes: 
e The division is performed such that the remainder operand (unless it is 0) has the same sign 
as the dividend operand. 
e On overflow, the operands are affected as in 3. below. 
e If the divisor operand is 0, then the quotient operand is replaced by bits 31:0 of the dividend 


operand, and the remainder operand is replaced by 0. 
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EMUL Extended Multiply 
Format: 

opcode mulr.rl, muld.rl, add.rl, prod.wq 
Operation: 

prod <- {muld * mulr} + SEXT(add); 


Condition Codes: 


N <- prod LSS 0; 
Z <- prod EQL 0; 
V <- 0; 
C= “0s 

Exceptions: 
none 


Opcodes: 


7A EMUL Extended Multiply 


Description: 


The multiplicand operand is multiplied by the multiplier operand giving a double length result. The addend 
operand is sign-extended to double length and added to the result. The product operand is replaced by the 
final result. 
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INC Increment 
Format: 

opcode sum.mx 
Operation: 

sum <- sum + 1; 


Condition Codes: 


N <- sum LSS 0; 

Z <- sum EQL 0; 

V <- {integer overflow}; 

Cc <- {carry from most significant bit}; 
Exceptions: 


integer overflow 


Opcodes: 
96 INCB Increment Byte 
B6 INCW Increment Word 
D6 INCL Increment Long 
Description: 


One is added to the sum operand and the sum operand is replaced by the result. 


Notes: 


e Arithmetic overflow occurs if the largest positive integer is incremented. On overflow, the sum 
operand is replaced by the largest negative integer. 


e INCx sum is equivalent to ADDx S*#1, sum, but is 1 byte shorter. 
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MCOM Move Complemented 
Format: 

opcode src.rx, dst.wx 
Operation: 

dst <- NOT src; 


Condition Codes: 


N <- dst LSS 0; 
Z <- dst EQL 0; 
V <- 0; 
C <= Gs 
Exceptions: 
none 
Opcodes: 


92 MCOMB Move Complemented Byte 
B2 MCOMW Move Complemented Word 
D2 MCOML Move Complemented Long 


Description: 


The destination operand is replaced by the ones complement of the source operand. 
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MNEG Move Negated 
Format: 

opcode src.rx, dsSt.wx 
Operation: 

dst <- -src; 


Condition Codes: 


N <- dst LSS QO; 
Z<- dst EQL 0; 
Vv <- {integer overflow}; 
C <- dst NEQ 0; 
Exceptions: 
integer overflow 
Opcodes: 


8E MNEGB Move Negated Byte 
AE MNEGW Move Negated Word 
CE MNEGL Move Negated Long 


Description: 
The destination operand is replaced by the negative of the source operand. 
Notes: 


Integer overflow occurs if the source operand is the largest negative integer (which has no positive 
counterpart). On overflow, the destination operand is replaced by the source operand. 
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MOV Move 
Format: 

opcode src.rx, dst.wx 
Operation: 

dst <- src; 


Condition Codes: 


N <- dst LSS 0; 
Z<- dst EQL 0; 
V <- OQ; 
Cc. <= ¢ 
Exceptions: 
none 
Opcodes: 


90 MOVB Move Byte 
BO MOVW Move Word 
DO MOVL Move Long 
7D MOVQ Move Quad 


7TDFD MOVO Move Octa 


Description: 


The destination operand is replaced by the source operand. 
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MOVZ Move Zero-Extended 
Format: 

opcode src.rx, dst.wy 
Operation: 

dst <- ZEXT(src); 


Condition Codes: 


N <- 0; 
Z <- dst EQL 0; 
V <- 0; 
C-<= Cs 
Exceptions: 
none 
Opcodes: 


9B MOVZBW Move Zero-Extended Byte to Word 
9A MOVZBL Move Zero-Extended Byte to Long 
3C MOVZWL Move Zero-Extended Word to Long 


Description: 


For MOVZBW, bits 7:0 of the destination operand are replaced by the source operand; bits 15:8 are replaced 
by zero. For MOVZBL, bits 7:0 of the destination operand are replaced by the source operand; bits 31:8 
are replaced by 0. For MOVZWL, bits 15:0 of the destination operand are replaced by the source operand; 
bits 31:16 are replaced by 0. 
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MUL 


Format: 


opcode mulr.rx, prod.mx 


Multiply 


2 operand 


opcode mulr.rx, muld.rx, prod.wx 3 operand 


Operation: 


prod <- prod * mulr; 


prod 


Condition Codes: 


<- muld * mulr; 


prod LSS 0; 
prod EQL 0; 


!2 operand 


!3 operand 


{integer overflow}; 


0; 


integer overflow 


N <- 
Li <= 
V <- 
C= 
Exceptions: 
Opcodes: 
84 MULB2 


85 MULB3 
A4 MULW2 
A5 MULW3 
C4 MULL2 
C5 MULL3 


Description: 


In 2 operand format, the product operand is multiplied by the multiplier operand and the product operand 
is replaced by the low half of the double length result. In 3 operand format, the multiplicand operand is 
multiplied by the multiplier operand and the product operand is replaced by the low half of the double 


length result. 


Notes: 


Integer overflow occurs if the high half of the double length result is not equal to the sign extension of 


the low half. 


Multiply 
Multiply 
Multiply 
Multiply 
Multiply 
Multiply 


Byte 
Byte 
Word 
Word 
Long 
Long 


WN WN W NHN 


Operand 
Operand 
Operand 
Operand 
Operand 
Operand 
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PUSHL Push Long 
Format: 

opcode src.rl 
Operation: 

-~(SP) <- src; 


Condition Codes: 


N <- src LSS 0; 

Z<- src EQL 0; 

V <- 0: 

© <= ‘Cs 
Exceptions: 

none 


Opcodes: 


DD PUSHL Push Long 


Description: 
The longword source operand is pushed on the stack. 
Notes: 


PUSHL is equivalent to MOVL src, -(SP), but is 1 byte shorter. 
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ROTL Rotate Long 
Format: 

opcode cnt.rb, src.rl, dst.wl 
Operation: 

dst <- src rotated cnt bits; 


Condition Codes: 


N <- dst LSS 0; 
Z<- dst EQL 0; 
V <- O; 
Cs] Ce 
Exceptions: 
none 
Opcodes: 


9C ROTL Rotate Long 


Description: 


The source operand is rotated logically by the number of bits specified by the count operand and the 
destination operand is replaced by the result. The source operand is unaffected. A positive count operand 
rotates to the left. A negative count operand rotates to the right. A 0 count operand replaces the destination 
operand with the source operand. 
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SBWC Subtract With Carry 
Format: 

opcode sub.rl, dif.ml 
Operation: 

dif <- dif - sub - C; 
Condition Codes: 
<- dif LSS 0; 
<- dif EQL 0; 


<- {integer overflow}; 
<- {borrow into most significant bit}; 


ANS 


Exceptions: 
integer overflow 
Opcodes: 


D9 SBWC Subtract With Carry 


Description: 


The subtrahend operand and the contents of the condition code C bit are subtracted from the difference 
operand and the difference operand is replaced by the result. 


Notes: 
° On overflow, the difference operand is replaced by the low order bits of the true result. 


e The 2 subtractions in the operation are performed simultaneously. 
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SUB Subtract 
Format: 
opcode sub.rx, dif.mx 2 operand 
opcode sub.rx, min.rx, Gdif.wx 3 operand 
Operation: 
dif <- dif - sub; !2 operand 
dif <- min - sub; !3 operand 


Condition Codes: 


N <- dif LSS 0; 

Z<- dif EQL 0; 

Vv <- {integer overflow}; 

C <- {borrow into most significant bit}; 
Exceptions: 


integer overflow 


Opcodes: 
82 SUBB2 Subtract Byte 2 Operand 
83 SUBB3 Subtract Byte 3 Operand 
A2 SUBW2 Subtract Word 2 Operand 
A3 SUBW3 Subtract Word 3 Operand 
C2 SUBL2 Subtract Long 2 Operand 
C3 SUBL3 Subtract Long 3 Operand 

Description: 


In 2 operand format, the subtrahend operand is subtracted from the difference operand and the difference 
operand is replaced by the result. In 3 operand format, the subtrahend operand is subtracted from the 


minuend operand and the difference operand is replaced by the result. 


Notes: 


Integer overflow occurs if the input operands to the subtract are of different signs and the sign of the result 
is the sign of the subtrahend. On overflow, the difference operand is replaced by the low order bits of the 


true result. 
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TST Test 
Format: 

opcode src.rx 
Operation: 

src — 0% 


Condition Codes: 


N <- src LSS 0; 
Z<- src EQL 0; 
V <- 0; 
Cc <- 0; 
Exceptions: 
none 
Opcodes: 


95 TSTB Test Byte 
B5 TSTW Test Word 
D5 TSTL Test Long 


Description: 
The condition codes are affected according to the value of the source operand. 
Notes: 


TSTx sre is equivalent to CMPx src, S*#0, but is 1 byte shorter. 


INSTRUCTIONS Page 4-35 
Integer Arithmetic and Logical Instructions 


XOR Exclusive OR 
Format: 
opcode mask.rx, dst.mx 2 operand 
opcode mask.rx, src.rx, dst.wx 3 operand 
Operation: 
dst <- dst XOR mask; !2 operand 
dst <- src XOR mask; !3 operand 


Condition Codes: 


N <- dst LSS 0; 
Z<- dst EQL 0; 
V <- OQ; 
Cc <=: Cs 
Exceptions: 
none 
Opcodes: 
8C XORB2 Exclusive OR Byte 2 Operand 
8D XORB3 Exclusive OR Byte 3 Operand 
AC XORW2 Exclusive OR Word 2 Operand 
AD XORW3 Exclusive OR Word 3 Operand 
CC XORL2 Exclusive OR Long 2 Operand 
CD XORL3 ExcluSive OR Long 3 Operand 


Description: 


In 2 operand format, the mask operand is XORed with the destination operand and the destination operand 
is replaced by the result. In 3 operand format, the mask operand is XORed with the source operand and 


INSTRUCTIONS 
Address Instructions 


the destination operand is replaced by the result. 
4.3 ADDRESS INSTRUCTIONS 
The following instructions are described in this section. 


e Move Address 
MOVA{B,W,L=F,Q=D=G,0=H} src.ax, dst.wl 


e Push Address 
PUSHA{B,W,L=F,Q=D=G,O=H} src.ax, {-(SP).wl} 
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MOVA Move Address 
Format: 

opcode src.ax, dst.wl 
Operation: 

dst <- src; 


Condition Codes: 


N <- dst LSS 0; 
Z<- dst EQL 0; 
V <- Q; 
Cc. <=-“Ce 
Exceptions: 
none 
Opcodes: 


SE MOVAB Move Address Byte 
3E MOVAW Move Address Word 
DE MOVAL, Move Address Long 
MOVAF Move Address F floating 
7E MOVAQ, Move Address Quad 
MOVAD, Move Address D floating 
MOVAG Move Address G floating 
7EFD MOVAH Move Address H floating, 
MOVAO Move Address Octa 


Description: 

The destination operand is replaced by the source operand. The context in which the source operand is 
evaluated is given by the data type of the instruction. The operand whose address replaces the destination 
operand is not referenced. 


Notes: 


The source operand is of address access type which causes the address of the specified operand to be 
moved. 
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PUSHA Push Address 
Format: 

opcode src.ax 
Operation: 

-(SP) <- src; 


Condition Codes: 


N <- src LSS 0; 
Z<- src EQL 0; 
V <- 0; 
Cc. <= “Ce 
Exceptions: 
none 
Opcodes: 


OF PUSHAB Push Address Byte 

3F PUSHAW Push Address Word 

DF PUSHAL Push Address Long, 
PUSHAF Push Address F_ floating 

7F PUSHAQ Push Address Quad, 
PUSHAD Push Address D floating, 
PUSHAG Push Address G floating 

7FFD PUSHAH Push Address H floating, 
PUSHAO Push Address Octa 


Description: 


The source operand is pushed on the stack. The context in which the source operand is evaluated is given 
by the data type of the instruction. The operand whose address is pushed is not referenced. 


Notes: 
e PUSHAx src is equivalent to MOVAx src, -(SP), but is 1 byte shorter. 


e The source operand is of address access type which causes the address of the specified 
operand to be pushed. 
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4.4 VARIABLE LENGTH BIT FIELD INSTRUCTIONS 
A variable length bit field is specified by 3 operands: 
e A longword position operand. 


e A byte field size operand which must be in the range O through 32 or a reserved operand 
fault occurs. 


e A base address (relative to which the position is used to locate the bit field). Tne address is 
obtained from an operand of address access type. However, unlike other instances of operand 
specifiers of address access type, register mode may be designated in the operand specifier. 
In this case the field is contained in the register n designated by the operand specifier (or 
register n+1 concatenated with register n). (See Chapter 2) If the field is contained in a 
register and size is not zero, the position operand must have a value in the range O through 
31 or a reserved operand fault occurs. 


In order to simplify the description of the variable bit field instructions, a macro FIELD(pos, size, address) 
is introduced with the following expansion (if size NEQ 0): 


FIELD(pos, size, address) 
=(address + SEXT(pos<31:3>))<{size - 1} + pos<2:0>:pos<2:0>> 
!if address not specified by register mode 


{R[n+1]'Rn}<{size - 1} + pos:pos> 


!if address specified by register mode and pos + size 
{GTRU 32 


Rn<{size - 1} + pos:pos> 


!if address specified by register mode and pos + size 
!LEQU 32 


The number of bytes referenced by the contents ( ) operator 
above 1S: 
1+ {{{size - 1} + pos<2:0>} / 8} 


Zero bytes are referenced if the field size is 0. 
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The following instructions are described in this section. 
e Compare Field 


CMPV pos.rl, size.rb, base.vb, {field.rv}, src.rl 


e Compare Zero-Extended Field 
CMPZV pos.rl, size.rb, base.vb, {field.rv}, src.rl 


° Extract Field 
EXTV pos.rl, size.rb, base.vb, {field.rv}, dst.wl 


® Extract Zero-Extended Field 
EXTZV pos.rl, size.rb, base.vb, {field.rv}, dst.wl 


° Find First 
FF{S,C} startpos.rl, size.rb, base.vb, {field.rv}, findpos.wl 


° Insert Field 
INSV src.rl, pos.rl, size.rb, base.vb, {field.wv} 
The following variable bit field instructions are described in the section on Control Instructions. 


° Branch on Bit 
BB{S,C} pos.rl, base.vb, displ.bb, {field.rv} 


° Branch on Bit (and modify without interlock) 
BB{S,C}{S,C} pos.rl, base.vb, displ.bb, {field.mv} 


e Branch on Bit (and modify) Interlocked 
BB{SS,CC}! pos.rl, base.vb, displ.bb, {field.mv} 
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CMP Compare Field 
Format: 

opcode pos.rl, size.rb, base.vb, src.rl 
Operation: 


tmp <- if size NEQU 0 then SEXT(FIELD (pos, size, base)) 


else 0; !CMPV 
tmp <- if size NEQU 0 then ZEXT(FIELD (pos, size, base)) 
else 0; !CMPZV 


tmp - src; 


Condition Codes: 


N <- tmp LSS src; 
Z<- tmp EQL src; 
V <- Q; 
C <- tmp LSSU src; 
Exceptions: 
reserved operand 
Opcodes: 
EC CMPV Compare Field 
ED CMPZV Compare Zero-Extended Field 
Description: 


The field specified by the position, size and base operands is compared with the source operand. For 
CMPV, the source operand is compared with the sign extended field. For CMPZV, the source operand is 
compared with the zero extended field. The only action is to affect the condition codes. 
Notes: 
e A reserved operand fault occurs if: 
le size GTRU 32. 


2. pos GTRU 31, size NEQ 0, and the field is contained in the registers. 


° On a reserved operand fault, the condition codes are UNPREDICTABLE. 
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E 


Format: 


xT Extract Field 


opcode pos.rl, size.rb, base.vb, dst.wl 


Operation: 


d 


d 


Condition Co 


ANS 


Exceptions: 
r 
Opcodes: 


EE BE 
KF EB 


Description: 


st <- if size NEQU 0 then SEXT(FIELD(pos, size, base) ) 


else Q; !EXTV 
st <- if size NEQU 0 then ZEXT(FIELD(pos, size, base) ) 
else 0; {EXTZV 
des: 
<- dst LSS 0; 
<- dst EQL 0; 
<- 0: 
<= GC 


eserved operand 


XTV Extract Field 
XTZV Extract Zero-Extended Field 


For EXTV, the destination operand is replaced by the sign extended field specified by the position, size, 
and base operands. For EXTZV, the destination operand is replaced by the zero extended field specified 
by the position, size and base operands. If the size operand is 0, the only action is to replace the destination 


operand with 


Notes: 


0 and affect the condition codes. 


A reserved operand fault occurs if: 
1. size GTRU 32. 
2. pos GTRU 31, size NEQ 0, and the field is contained in the registers. 


On a reserved operand fault, the destination operand is unaffected and the condition codes 
are UNPREDICTABLE. 
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FF Find First 
Format: 

opcode startpos.rl, size.rb, base.vb, findpos.wl 
Operation: 


state = if {FFS} then 1 else 0; 
if size NEQU O then 


begin 
tmpl <- FIELD(startpos, size, base); 
tmp2 <- 0; 


while {tmpl<tmp2> NEQ state} AND 
{tmp2 LEQU {size - 1}} do 
tmp2 <- tmp2 + 1; 
findpos <- startpos + tmp2; 
end 
else 
findpos <- startpos; 


Condition Codes: 


N <- 0; 
Z<- {bit not found}; 
V <- OQ; 
C <- Q; 
Exceptions: 
reserved operand 
Opcodes: 
EB FFC Find First Clear 
EA FFS Find First Set 
Description: 


A field specified by the start position, size, and base operands is extracted. The field is tested for a bit in 
the state indicated by the instruction starting at bit O and extending to the highest bit in the field. If a bit 
in the indicated state is found, the find position operand is replaced by the position of the bit and the Z 
condition code bit is cleared. If no bit in the indicated state is found, the find position operand is replaced 
by the position (relative to the base) of a bit one position to the left of the specified field, and the Z 
condition code bit is set. If the size operand is 0, the find position operand is replaced by the start position 
operand and the Z condition code bit is set. 
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Notes: 
° A reserved operand fault occurs if: 
1. size GTRU 32. 
2. startpos GTRU 31, size NEQ 0, and the field is contained in the registers. 


e On a reserved operand fault, the find position operand is unaffected and the condition codes 
are UNPREDICTABLE. 


INSTRUCTIONS Page 4-45 
Variable Length Bit Field Instructions 


INSV Insert Field 
Format: 
opcode src.rl, pos.rl, size.rb, base.vb 
Operation: 
if size NEQU 0 then FIELD(pos, size, base) <- src<{size-1}:0>; 


Condition Codes: 


N <- N; 

4 S= Le 

V <- V; 

Cs Ce 
Exceptions: 

reserved operand 
Opcodes: 

FO INSV Insert Field 

Description: 


The field specified by the position, size, and base operands is replaced by bits size-1:0 of the source 
operand. If the size operand is 0, the instruction has no effect. 


Notes: 
e A reserved operand fault occurs if: 
1. size GTRU 32. 
2. pos GTRU 31, size NEQ 0, and the field is contained in the registers. 


e On a reserved operand fault, the field is unaffected and the condition codes are 
UNPREDICTABLE. 
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4.5 CONTROL INSTRUCTIONS 


In most implementations of the VAX architecture, improved execution speed will result if the target of a 
control instruction is on an aligned longword boundary. 


The following instructions are described in this section. 
° Add Compare and Branch 
ACB{B,W,L,F,D,G,H} limit.rx, add.rx, index.mx, displ.bw 


Compare is LE on positive add, GE on negative add. 


° Add One and Branch Less Than or Equal 
ABLEQ limit.rl, index.ml, displ.bb 


e Add One and Branch Less Than 
AOBLSS limit.rl, index.ml, displ.bb 


e Conditional Branch 
B{condition} displ.bb 


Condition Name 
LSS Less Than 
LEQ Less Than or Equal 
EQL, EQLU Equal, Equal Unsigned 
NEQ, NEQU Not Equal, Not Equal Unsigned 
GEQ Greater Than or Equal 
GTR Greater Than 
LSSU, CS Less Than Unsigned, Carry Set 
LEQU Less Than or Equal Unsigned 
GEQU, CC Greater Than or Equal Unsigned, 
Carry Clear 
GTRU Greater Than Unsigned 
VS Overflow Set 
VC Overflow Clear 
e Branch on Bit 


BB{S,C} pos.rl, base.vb, displ.bb, {field.rv} 


e Branch on Bit (and modify without interlock) 
BB{S,C}{S,C} pos.rl, base.vb, displ.bb, {field.mv} 


e Branch on Bit (and modify) Interlocked 
BB{SS,CC}I pos.rl, base.vb, displ.bb, {field.mv} 


® Branch on Low Bit 
BLB{S,C} src.rl, displ.bb 
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e Branch With {Byte, Word} Displacement 
BR{B,W} displ.bx 


e Branch to Subroutine With {Byte, Word} Displacement 
BSB{B,W} displ.bx, {-(SP).wi} 


° Case 
CASE{B,W,L} selector.rx, base.rx, limit.rx, displ.bw-list 


e Jump 
JMP dst.ab 
° Jump to Subroutine 


JSB dst.ab, {-(SP).wl} 


8 Return from Subroutine 
RSB {(SP) +.rl} 


e Subtract One and Branch Greater Than or Equal 
SOBGEQ index.ml, displ.bb 


e Subtract One and Branch Greater Than 
SOBGTR index.ml, displ.bb 
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ACB Add Compare and Branch 
Format: 
opcode limit.rx, add.rx, index.mx, displ.bw 
Operation: 
index <- index + add; 
if {{add GEQ 0} AND {index LEQ limit}} OR 
{{add LSS 0} AND {index GEQ limit}} then 
PC <- PC + SEXT(displ); 


Condition Codes: 


N <- index LSS 0; 
Z <- index EQL 0; 
V <- {integer overflow}; 
Ca C? 
Exceptions: 


integer overflow 
floating overflow 
floating underflow 
reserved operand 


Opcodes: 


9D ACBB Add Compare and Branch Byte 
3D ACBW Add Compare and Branch Word 
Fi ACBL Add Compare and Branch Long 
4F ACBF Add Compare and Branch F floating 
6F ACBD Add Compare and Branch D floating 
4FFD ACBG Add Compare and Branch G floating 
6FFD ACBH Add Compare and Branch H floating 


Description: 


The addend operand is added to the index operand and the index operand is replaced by the result. The 
index operand is compared with the limit operand. If the addend operand is positive (or 0) and the comparison 
is less than or equal or if the addend is negative and the comparison is greater than or equal, the 
sign-extended branch displacement is added to PC and PC is replaced by the result. 
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Notes: 


° ACB efficiently implements the general FOR or DO loops in high level languages since the 
sense of the comparison between index and limit is dependent on the sign of the addend. 


e On integer overflow, the index operand is replaced by the low order bits of the true result. 
Comparison and branch determination proceed normally on the updated index operand. 


e On floating underflow, if FU is clear, the index operand is replaced by 0 and comparison and 
branch determination proceed normally. A fault occurs if FU is set and the index operand is 
unaffected. 

° On floating overflow, the instruction takes a floating overflow fault and the index operand is 
unaffected. 

e On a reserved operand fault, the index operand is unaffected and the condition codes are 


UNPREDICTABLE. 
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AOBLEQ Add One and Branch Less Than or Equal 
Format: 
opcode limit.rl, index.ml, displ.bb 
Operation: 
index <- index + 1; 
if index LEQ limit then PC <- 
PC + SEXT(displ); 


Condition Codes: 


N <- index LSS 0; 

Z <- index EQL 0; 

Vv <- {integer overflow}; 
Cc. <= Cs 


Exceptions: 
integer overflow 
Opcodes: 
F3 AOBLEQ Add One and Branch Less Than or Equal 


Description: 


One is added to the index operand and the index operand is replaced by the result. The index operand is 
compared with the limit operand. If it is less than or equal, the sign-extended branch displacement is added 


to PC and PC is replaced by the result. 


Notes: 


e Integer overflow occurs if the index operand before addition is the largest positive integer. On 
overflow, the index operand is replaced by the largest negative integer, and the branch is 


taken. 


® The C-bit is unaffected. 
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AOBLSS Add One and Branch Less Than 
Format: 
opcode limit.rl, index.ml, displ.bb 
Operation: 
index <- index + 1: 
if index LSS limit then PC <- 
PC + SEXT(displ); 


Condition Codes: 


N <- index LSS 0: 

Z <- index EQL 0; 

V <- {integer overflow}; 
C=" Ge 


Exceptions: 
integer overflow 
Opcodes: 


F2 AOBLSS Add One and Branch Less Than 


Description: 
One is added to the index operand and the index operand is replaced by the result. The index operand is 
compared with the limit operand. If it is less than, the sign-extended branch displacement is added to the 
PC and PC is replaced by the result. 
Notes: 
e Integer overflow occurs if the index operand before addition is the largest positive integer. On 
overflow, the index operand is replaced by the largest negative integer, and thus (unless the 


limit operand is the largest negative integer) the branch is taken. 


@ The C-bit is unaffected. 
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B Branch on (condition) 
Format: 
opcode displ.bb 
Operation: 
if condition then PC <- PC + SEXT(displ); 


Condition Codes: 


N <- N;3 

Ls Ls 

V <- V; 

C <= Cs 
Exceptions: 

none 


Opcodes: Condition 


14 
15 
12 


13 


1F 


{N OR 
{N OR 
Z EQL 
Z EQL 
N EQL 


N EQL 
{C OR 


{C OR 
V EQL 


V EQL 
C EQL 


C EQL 


Description: 


The condition codes are tested and if the condition indicated by the instruction is met, the sign-extended 


Z} EQL 0 
Z} EQL 1 


Z} EQL 0 


Z} EQL 1 


BGTR 
BLEQ 


BNEQ, 
BNEQU 
BEQL, 
BEQLU 
BGEQ 


BLSS 
BGTRU 


BLEQU 


BVC 
BVS 


BGEQU, 


BCC 


BLSSU, 


BCS 


Branch on Greater Than 
(signed) 

Branch on Less Than or Equal 
(signed) 

Branch on Not Equal (signed) 
Branch on Not Equal Unsigned 
Branch on Equal (signed) 
Branch on Equal Unsigned 
Branch on Greater Than or 
Equal (signed) 

Branch on Less Than (signed) 
Branch on Greater Than 
Unsigned 

Branch Less Than or Equal 
Unsigned 

Branch on Overflow Clear 
Branch on Overflow Set 
Branch on Greater Than or 
Equal Unsigned 

Branch on Carry Clear 

Branch on Less Than Unsigned 
Branch on Carry Set 


branch displacement is added to the PC and PC is replaced by the result. 
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Notes: 
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The VAX conditional branch instructions permit considerable flexibility in branching but require care in 
choosing the correct branch instruction. The conditional branch instructions are best seen as 3 overlapping 


groups: 
° Overflow and Carry Group 
BVS V EQL 1 
BVC V EQL 0 
BCS C BOL 1 
BCC C EQL 0 


These instructions are typically used to check for overflow (when overflow traps are not enabled), 
for multiprecision arithmetic, and for other special purposes. 


e Unsigned Group 


BLSSU 
BLEQU 
BEQLU 
BNEQU 
BGEQU 
BGTRU 


C BOL 
{C OR 
Z EOL 
Z EQL 
C EQL 
{C OR 


i 
Z} EQL 1 
i} 
0 
0 
Z} EQL 0 


These instructions typically follow integer and field instructions where the operands are treated 
as unsigned integers, address instructions, and character string instructions. 


° Signed Group 


BLSS 
BLEQ 
BEQL 
BNEQ 
BGEQ 
BGTR 


N EQL 
{N OR 
Z EQL 
Z EOL 
N EQL 
{N OR 


1 
Z} EQL 1 
1 
0 
0 
Z} EQL 0 


These instructions typically follow integer and field instructions where the operands are being 
treated as signed integers, floating point instructions, and decimal string instructions. 
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BB Branch on Bit 
Format: 
opcode pos.rl, base.vb, displ.bb 
Operation: 
teststate = if {BBS} then 1 else 0; 
if FIELD(pos, 1, base) EQL teststate then 
PC <- PC + SEXT(displ); 


Condition Codes: 


N <- N;3 
ZL s= Ze 
V <- V3 
C <= :Ce 


Exceptions: 


reserved operand 


Opcodes: 
E0 BBS Branch on Bit Set 
El BBC Branch on Bit Clear 
Description: 


The single bit field specified by the position and base operands is tested. If it is in the test state indicated 
by the instruction, the sign-extended branch displacement is added to PC and PC is replaced by the result. 


Notes: 
e A reserved operand fault occurs if pos GTRU 31 and the bit is contained in a register. 


e On a reserved operand fault, the condition codes are UNPREDICTABLE. 
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Format: 


Operation: 


BB Branch on Bit (and modify without interlock) 


opcode pos.rl, base.vb, displ.bb 


teststate = if {BBSS or BBSC} then 1 else 0; 
newstate = if {BBSS or BBCS} then 1 else 0; 
tmp <- FIELD(pos, 1, base); 
FIELD(pos, 1, base) <- newstate; 
if tmp EQL teststate then 

PC <- PC + SEXT(displ); 


Condition Codes: 


Exceptions: 


Opcodes: 


E2 
E3 
B4 
E5 


Description: 


The single bit field specified by the position and base operands is tested. If it is in the test state indicated 
by the instruction, the sign-extended branch displacement is added to PC and PC is replaced by the result. 
Regardless of whether the branch is taken or not, the tested bit is put in the new state as indicated by 


N <- N; 
ZL. a= Le 
Vy see Ys 
C <= Cs 


reserved operand 


BBSS Branch on Bit Set and Set 
BBCS Branch on Bit Clear and Set 
BBSC Branch on Bit Set and Clear 
BBCC Branch on Bit Clear and Clear 


the instruction. 


Notes: 


A reserved operand fault occurs if pos GTRU 31 and the bit is contained in a register. 


On a reserved operand fault, the field is unaffected and the condition codes are 


UNPREDICTABLE. 


The modification of the bit is not an interlocked operation. 
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Format: 


Operation: 


BB Branch on Bit Interlocked 


opcode pos.rl, base.vb, displ.bb 


teststate = if {BBSSI} then 1 else 0; 
newstate = teststate; 
{set interlock}; 
tmp <- FIELD(pos, 1, base); 
FIELD(pos, 1, base) <- newstate; 
{release interlock}: 
if tmp EQL teststate then 

PC <- PC + SEXT(displ); 


Condition Codes: 


Exceptions: 


Opcodes: 


6 
E7 


Description: 


The single bit field specified by the position and base operands is tested. If it is in the test state indicated 
by the instruction, the sign-extended branch displacement is added to the PC and PC is replaced by the 
result. Regardless of whether the branch is effected or not, the tested bit is put in the new state as indicated 
by the instruction. If the bit is contained in memory, the reading of the state of the bit and the setting of 
it to the new state is an interlocked operation. No other processor or I/O device can do an interlocked 


N <- N; 
L: So ss 
Vo <= Ve 
Cc <-.Cs 


reserved operand 


BBSSI Branch on Bit Set and Set Interlocked 
BBCCI Branch on Bit Clear and Clear Interlocked 


access on the bit during the interlocked operation. 


Notes: 
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A reserved operand fault occurs if pos GTRU 31 and the bit is contained in registers. 


On a reserved operand fault, the field is unaffected and the condition codes are 


UNPREDICTABLE. 


Except for memory interlocking BBSSI is equivalent to BBSS and BBCCI is equivalent to 


BBCC. 
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e This instruction is designed to modify interlocks with other processors or devices. For example, 
to implement "busy waiting": 


1s; BBSSI bit,base,1$ 
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BLB Branch on Low Bit 
Format: 
opcode src.rl, displ.bb 
Operation: 
teststate = if {BLBS} then 1 else 0; 
if src<0> EQL teststate then 
PC <- PC + SEXT(displ); 


Condition Codes: 


N <- N3 
ZA. = Ze 
V-<= Ve 
C:<=:-C: 
Exceptions: 
none 
Opcodes: 
E8 BLBS Branch on Low Bit Set 
B9 BLBC Branch on Low Bit Clear 
Description: 


The low bit (bit 0) of the source operand is tested and if it is equal to the test state indicated by the 
instruction, the sign-extended branch displacement is added to PC and PC is replaced by the result. 
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BR Branch 
Format: 

opcode displ.bx 
Operation: 

PC <- PC + SEXT(displ); 


Condition Codes: 


N <- N;3 
As Zs 
V <= Ve 
C <="C> 
Exceptions: 
none 
Opcodes: 
11 BRB Branch With Byte Displacement 
31 BRW Branch With Word Displacement 
Description: 


The sign-extended branch displacement is added to PC and PC is replaced by the result. 
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BSB Branch To Subroutine 
Format: 

opcode displ.bx 
Operation: 


-(SP) <- PC; 
PC <- PC + SEXT(displ); 


Condition Codes: 


N <- N; 
Lo 5 Ls 
V <- V3 
C <= Ce 
Exceptions: 
none 
Opcodes: 
10 BSBB Branch to Subroutine With Byte Displacement 
30 BSBW Branch to Subroutine With Word Displacement 
Description: 


PC is pushed on the stack as a longword. The sign-extended branch displacement is added to PC and PC 
is replaced by the result. 
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CASE Case 
Format: 


opcode selector.rx, base.rx, limit.rx, 
displ(0].bw,..., displ[limit].bw 


Operation: 
tmp <- selector - base; 
PC <- PC + if tmp LEQU limit then 
SEXT(displ(tmp]) else {2 + 2 * ZEXT(limit)}; 


Condition Codes: 


N <- tmp LSS limit; 

Z<- tmp EQL limit; 

V <- OQ; 

C <- tmp LSSU limit; 
Exceptions: 

none 


Opcodes: 


8F CASEB Case Byte 
AF CASEW Case Word 
CF CASEL Case Long 


Description: 


The base operand is subtracted from the selector operand and a temporary is replaced by the result. The 
temporary is compared with the limit operand and if it is less than or equal unsigned, a branch displacement 
selected by the temporary value is added to PC and PC is replaced by the result. Otherwise, 2 times the 
sum of the limit operand and 1 is added to PC and PC is replaced by the result. This causes PC to be 
moved past the array of branch displacements. Regardless of the branch taken, the condition codes are 
affected by the comparison of the temporary operand with the limit operand. 


Notes: 


° After operand evaluation, PC is pointing at displ[O], not the next instruction. The branch 
displacements are relative to the address of displ[O]. 


e The selector and base operands can both be considered either as signed or unsigned integers. 
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JMP Jump 
Format: 

opcode dst.ab 
Operation: 

PC <- dst; 


Condition Codes: 


N <- N;3 

ZL: S= Ze 

V <- V3; 

C. <= Ce 
Exceptions: 

none 
Opcodes: 

17 JMP Jump 

Description: 


PC is replaced by the destination operand. 
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JSB Jump to Subroutine 
Format: 

opcode dst.ab 
Operation: 

-(SP) <- PC; 

PC <- dst; 


Condition Codes: 


N <- N;3 
Zs Zs 
V <=. Ve 
C=: (Ce 
Exceptions: 
none 
Opcodes: 
16 JSB Jump to Subroutine 
Description: 


PC is pushed on the stack as a longword. PC is replaced by the destination operand. 
Notes: 
Since the operand specifier conventions cause the evaluation of the destination operand before saving PC, 


JSB can be used for coroutine calls with the stack used for linkage. The form of such a call is JSB 
@(SP)+. 
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RSB Return from Subroutine 
Format: 

opcode 
Operation: 

PC <- (SP)+; 


Condition Codes: 


N <- N;3 
Zoo Le 
V <- V;3 
Cc. <= Cs 
Exceptions: 
none 
Opcodes: 
05 RSB Return From Subroutine 
Description: 


PC is replaced by a longword popped from the stack. 
Notes: 
° RSB is used to return from subroutines called by the BSBB, BSBW and JSB instructions. 


° RSB is equivalent to JMP @(SP)+, but is 1 byte shorter. 
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SOBGEQ Subtract One and Branch Greater Than or Equal 
Format: 
opcode index.ml, displ.bb 
Operation: 
index <- index - 1; 
if index GEQ 0 then PC <- 
PC + SEXT(displ); 


Condition Codes: 


N <- index LSS 0; 
Z <- index EQL 0; 
V <- {integer overflow}; 
Cr ses Ce 
Exceptions: 
integer overflow 
Opcodes: 
F4 SOBGEQ Subtract One and Branch Greater Than or Equal 
Description: 


One is subtracted from the index operand and the index operand is replaced by the result. If the index 
operand is greater than or equal to 0, the sign-extended branch displacement is added to PC and PC is 
replaced by the result. 


Notes: 
e Integer overflow occurs if the index operand before subtraction is the largest negative integer. 
On overflow, the index operand is replaced by the largest positive integer, and thus the branch 
is taken. 


° The C-bit is unaffected. 
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SOBGTR Subtract One and Branch Greater Than 
Format: 
opcode index.ml, displ.bb 
Operation: 
index <- index - 1; 
if index GTR O then PC <- 
PC + SEXT(displ); 


Condition Codes: 


N <- index LSS 0; 
Z <- index EQL 0; 
V <- {integer overflow}; 
C: <= "Cs 
Exceptions: 
integer overflow 
Opcodes: 
F5 SOBGTR Subtract One and Branch Greater Than 
Description: 


One is subtracted from the index operand and the index operand is replaced by the result. If the index 
operand is greater than 0, the sign-extended branch displacement is added to PC and PC is replaced by 


the result. 


Notes: 


° Integer overflow occurs if the index operand before subtraction is the largest negative integer. 
On overflow, the index operand is replaced by the largest positive integer, and thus the branch 


is taken. 


@ The C-bit is unaffected. 
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4.6 PROCEDURE CALL INSTRUCTIONS 


Three instructions are used to implement a standard procedure calling interface. Two instructions implement 
the CALL to the procedure; the third implements the matching RETURN. Refer to the VAX/VMS Run Time 
Library Reference Manual for the procedure calling standard. The CALLG instruction calls a procedure with 
the argument list actuals in an arbitrary location. The CALLS instruction calls a procedure with the argument 
list actuals on the stack. Upon return after a CALLS this list is automatically removed from the stack. Both 
call instructions specify the address of the entry point of the procedure being called. The entry point is 
assumed to consist of a word termed the entry mask followed by the procedure’s instructions. The procedure 
terminates by executing a RET instruction. 


The entry mask specifies the subprocedure’s register use and overflow enables: 


11111 
654321 0 


D{I REGISTERS 
ViV 


On CALL the stack is aligned to a longword boundary and the trap enables in the PSW are set to a known 
state to ensure consistent behavior of the called procedure. Integer overflow enable and decimal overflow 
enable are affected according to bits 14 and 15 of the entry mask respectively. Floating underflow enable 
is cleared. The registers R11 through RO specified by bits 11 through 0 respectively are saved on the stack 
and are restored by the RET instruction. In addition, PC, SP, FP, and AP are always preserved by the 
CALL instructions and restored by the RET instruction. 


All external procedure CALLs generated by standard DIGITAL language processors, and all inter-module 
CALLs to major VAX software subsystems comply with the procedure calling software standard (see VAX/VMS 
Run Time Library Reference Manual, Appendix C). The procedure calling standard requires that all registers 
in the range R2 through R11 used in the procedure must appear in the mask. RO and R1 are not preserved 
by any called procedure that complies with the procedure calling standard. 


In order to preserve the state, the CALL instructions form a structure on the stack termed a call frame or 
stack frame. This contains the saved registers, the saved PSW, the register save mask, and several control 
bits. The frame also includes a longword which the CALL instructions clear; this is used to implement the 
VAX/VMS condition handling facility. Refer to VAX/VMS Run Time Library Reference Manual, Appendix C. 
At the end of execution of the CALL instruction, FP contains the address of the stack frame. The RET 
instruction uses the contents of FP to find the stack frame and restore state. The condition handling facility 
assumes that FP always points to the stack frame. The stack frame has the following format: 
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: (FP) 


mfp meno b[-meraae [0 


saved R11 (...) 


(0 to 3 bytes specified by SPA, Stack Pointer Alignment) 


set if CALLS; clear if CALLG. 

always cleared by CALL. Can be set by software to 

force a reserved operand fault on a RET. 

Note that the saved condition codes and the saved trace enable (PSW<T>) are cleared. 


N 
i 


The contents of the frame PSW<3:0> at the time RET is executed will become the condition codes resulting 
from the execution of the procedure. Similarly, the content of the frame PSW<4> at the time the RET is 
executed will become the PSW<T> bit. 


The following instructions are described in this section. 


e Call Procedure with General Argument List 
CALLG arglist.ab, dst.ab, {-(SP).w*} 


e Call Procedure with Stack Argument List 
CALLS numarg.rl, dst.ab, {-(SP).w*} 


e Return from Procedure 
RET {(SP)+.r*} 
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CALLG Call Procedure With General Argument List 
Format: 

opcode arglist.ab, dst.ab 
Operation: 

{align stack}; 

{create stack frame}: 

{set arithmetic exception enables}; 


{set new values of AP,FP,PC}; 


Condition Codes: 


N <- 0; 
Z<- Q; 
V <- QO; 
Cc <- 0; 


Exceptions: 
reserved operand 
Opcodes: 


FA CALLG Call Procedure with General Argument List 


Description: 


SP is saved in a temporary and then bits 1:0 are replaced by O so that the stack is longword aligned. The 
procedure entry mask is scanned from bit 11 to 0 and the contents of registers whose number corresponds 
to set bits in the mask are pushed on the stack as longwords. PC, FP, and AP are pushed on the stack 
as longwords. The condition codes are cleared. A longword containing the saved two low bits of SP in bits 
31:30, a O in bit 29 and bit 28, the low 12 bits of the procedure entry mask in bits 27:16, a O in bit 15 
and PSW<14:0> in bits 14:0 with T cleared is pushed on the stack. A longword 0 is pushed on the stack. 
FP is replaced by SP. AP is replaced by the arglist operand. The trap enables in the PSW are set to a 
known state. Integer overflow, and decimal overflow are affected according to bits 14 and 15 of the entry 
mask respectively; floating underflow is cleared. T-bit is unaffected. PC is replaced by the sum of destination 
operand plus 2 which transfers control to the called procedure at the byte beyond the entry mask. 
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: (SP) 
: (FP) 
stack 
frame 
(0 to 3 bytes specified by SPA) 
Notes: 
e If bits 13:12 of the entry mask are not 0, a reserved operand fault occurs. 


e On a reserved operand fault, condition codes are UNPREDICTABLE. 


° The procedure calling standard and the condition handling facility require the following register 
saving conventions. RO and Ri are always available for function return values and are never 
saved in the entry mask. All registers R2 through R11 which are modified in the called 
procedure must be preserved in the mask. Refer to VAX/VMS Run Time Library Reference 
Manual, Appendix C. 
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CALLS Call Procedure with Stack Argument List 
Format: 

opcode numarg.rl, dst.ab 
Operation: 

{push arg count}; 

{align stack}; 

{create stack frame}; 


{set arithmetic exception enables}; 
{set new values of AP,FP,PC}: 


Condition Codes: 


N <- Q; 
Z<-~ 0; 
V <- OQ; 
C <= "0% 


Exceptions: 
reserved operand 
Opcodes: 
FB CALLS Call Procedure With Stack Argument List 
Description: 


The numarg operand is pushed on the stack as a longword (byte 0 contains the number of arguments, 
high order 24 bits are used by DIGITAL software). SP is saved in a temporary and then bits 1:0 of SP are 
replaced by O so that the stack is longword aligned. The procedure entry mask is scanned from bit 11 to 
bit O and the contents of registers whose number corresponds to set bits in the mask are pushed on the 
stack. PC, FP, and AP are pushed on the stack as longwords. The condition codes are cleared. A longword 
containing the saved two low bits of SP in bits 31:30, a 1 in bit 29, a 0 in bit 28, the low 12 bits of the 
procedure entry mask in bits 27:16, a 0 in bit 15 and PSW<14:0> in bits 14:0 with T cleared is pushed 
on the stack. A longword 0 is pushed on the stack. FP is replaced by SP. AP is set to the value of the 
stack pointer after the numarg operand was pushed on the stack. The trap enables in the PSW are set to 
a known state. Integer overflow, and decimal overflow, are affected according to bits 14 and 15 of the 
entry mask, respectively, floating underflow is cleared. T-bit is unaffected. PC is replaced by the sum of 
destination operand plus 2 which transfers control to the called procedure at the byte beyond the entry 
mask. The appearance of the stack after CALLS is executed is: 
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: (SP) 
: (FP) 


stack 


frame 


(0 to 3 bytes specified by SPA) 


N longwords of argument list 


Notes: 
° If bits 13:12 of the entry mask are not 0, a reserved operand fault occurs. 
° On a reserved operand fault, the condition codes are UNPREDICTABLE. 


° Normal use is to push the arglist onto the stack in reverse order prior to the CALLS. On 
return, the arglist is removed from the stack automatically. 


e The procedure calling standard and the condition handling facility require the following register 
saving conventions. RO and R11 are always available for function return values and are never 
saved in the entry mask. All registers R2 through R11 which are modified in the called 
procedure must be preserved in the entry mask. Refer to VAX/VMS Run Time Library Reference 
Manual, Appendix C. 
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RET Return from Procedure 
Format: 
opcode 


Operation: 


{restore SP from FP}: 

{restore registers}; 

{drop stack alignment}; 

{if CALLS then remove arglist}; 
{restore PSW}; 


Condition Codes: 


<- tmpl<3>; 
<- tmpl<2>; 
<- tmpl<1>; 
<- tmp1<0>; 


ASNS 


Exceptions: 
reserved operand 
Opcodes: 
04 RET Return from Procedure 
Description: 


SP is replaced by FP plus 4. A longword containing stack alignment bits in bits 31:30, a CALLS/CALLG 
flag in bit 29, the low 12 bits of the procedure entry mask in bits 27:16, and a saved PSW in bits 15:0 
is popped from the stack and saved in a temporary. PC, FP, and AP are replaced by longwords popped 
from the stack. A register restore mask is formed from bits 27:16 of the temporary. Scanning from bit 0 
to bit 11 of the restore mask, the contents of registers whose number is indicated by set bits in the mask 
are replaced by longwords popped from the stack. SP is incremented by 31:30 of the temporary. PSW is 
replaced by bits 15:0 of the temporary. If bit 29 in the temporary is 1 (indicating that the procedure was 
called by CALLS), a longword containing the number of arguments is popped from the stack. Four times 
the unsigned value of the low byte of this longword is added to SP and SP is replaced by the result. 
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Notes: 

e A reserved operand fault occurs if tmp1<15:8> NEQ 0. 

e On a reserved operand fault, the condition codes are UNPREDICTABLE. 

° The value of tmp1<28> is ignored. 

° The procedure calling standard and condition handling facility assume that procedures which 
return a function value or a status code do so in RO or RO and R11. Refer to VAX/VMS Run 


Time Library Reference Manual, Appendix C. 


e If FP<1:0> is not zero, the results are UNPREDICTABLE. 
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4.7 MISCELLANEOUS INSTRUCTIONS 
The following instructions are described in this section. 


® Bit Clear PSW 
BICPSW mask.rw 


e Bit Set PSW 
BISPSW mask.rw 


e Breakpoint Fault 
BPT {-(KSP).w*} 


® Halt 
HALT {-(KSP).w*} 


e Index 
INDEX subscript.rl, low.rl, high.rl, size.rl, indexin.rl, indexout.wl 


e Move from PSL 
MOVPSL dst.wl 


° No Operation 
NOP 


e Pop Registers 
POPR mask.rw, {(SP)+.r*} 


° Push Registers 
PUSHR mask.rw, {-(SP).w*} 


° Extended Function Call 
XFC {unspecified operands} 
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BICPSW Bit Clear PSW 
Format: 

opcode mask.rw 
Operation: 

PSW <- PSW AND {NOT mask}; 
Condition Codes: 
<- N AND {NOT mask<3>} 
<- Z AND {NOT mask<2>} 


<—- V AND {NOT mask<1l>}; 
<- C AND {NOT mask<0>}; 


ASN] 


Exceptions: 
reserved operand 
Opcodes: 


BY BICPSW Bit Clear PSW 


Description: 
PSW is ANDed with the ones complement of the mask operand and PSW is replaced by the result. 
Notes: 


A reserved operand fault occurs if mask <15:8> is not zero. On a reserved operand fault, the PSW is not 
affected. 
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BISPSW Bit Set PSW 
Format: 

opcode mask.rw 
Operation: 

PSW <- PSW OR mask; 
Condition Codes: 
<- N OR mask<3>; 
<—- Z OR mask<2>; 


<- V OR mask<l1>; 
<- C OR mask<0>; 


ASN S|! 


Exceptions: 
reserved operand 
Opcodes: 


B8 BISPSW Bit Set PSW 


Description: 
PSW is ORed with the mask operand and PSW is replaced by the result. 
Notes: 


A reserved operand fault occurs if mask<15:8> is not zero. On a reserved operand fault, the PSW is not 
affected. 
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BPT Breakpoint Fault 
Format: 

opcode 
Operation: 


PSL<TP> <- 0; 
{breakpoint fault}; !push current PSL on stack 


Condition Codes: 


N <- 0; !condition codes cleared after BPT fault 
Z<- OQ; 
V <- 0; 
C <- 0: 

Exceptions: 
none 

Opcodes: 

03 BPT Breakpoint Fault 
Description: 


In order to understand the operation of this instruction, it is necessary to read Chapter 6. This instruction 
is used, together with the T-bit, to implement debugging facilities. 
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HALT Halt 
Format: 
opcode 
Operation: 
If PSL<current mode> NEQU kernel then 
{privileged instruction fault} 
else 


{halt the processor}; 


Condition Codes: 


N <- 0; !If privileged instruction fault 

Z<- 03; !condition codes are cleared after 

V <- 0; !the fault. PSL saved on stack 

C <- 0; !contains condition codes prior to HALT. 
N <- N; !If processor halt 

LS Le 

V <- V;3 

Css Ce 


Exceptions: 
privileged instruction 
Opcodes: 


00 HALT Halt 


Description: 


In order to understand the operation of this instruction it is necessary to read Chapter 6. If the process is 
running in kernel mode, the processor is halted. Otherwise, a privileged instruction fault occurs. 


Notes: 


This opcode is O to trap many branches to data. 
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INDEX Compute Index 


Format: 


opcode subscript.rl, low.rl, high.rl, 
size.rl, indexin.rl, indexout.wl 


Operation: 
indexout <- {indexin + subscript} *size; 
if {subscript LSS low} or {subscript GTR high} 
then {subscript range trap}; 


Condition Codes: 


N <- indexout LSS 0; 
Z <- indexout EQL 0; 
V <- 0; 
C <- 0: 

Exceptions: 


subscript range 
Opcodes: 


OA INDEX Compute Index 


Description: 


The indexin operand is added to the subscript operand and the sum multiplied by the size operand. The 
indexout operand is replaced by the result. If the subscript operand is less than the low operand or greater 
than the high operand, a subscript range trap is taken. 


Notes: 


° No arithmetic exception other than subscript range can result from this instruction. Thus no 
indication is given if overflow occurs in either the add or multiply steps. If overflow occurs on 
the add step the sum is the low order 32 bits of the true result. If overflow occurs on the 
multiply step, the indexout operand is replaced by the low order 32 bits of the true product 
of the sum and the subscript operand. In the normal use of this instruction, overflow cannot 
occur without a subscript range trap occurring. 


e The index instruction is useful in index calculations for arrays of the fixed length data types 
(integer and floating) and for index calculations for arrays of bit fields, character strings, and 
decimal strings. The indexin operand permits cascading INDEX instructions for multidimensional 
arrays. For one-dimensional bit field arrays it also permits introduction of the constant portion 
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of an index calculation which is not readily absorbed by address arithmetic. The following 
notes will show some of the uses of INDEX. 


® The COBOL statements: 
Ol A-ARRAY. 
02 A PIC X(25) OCCURS 15 TIMES INDEXED BY I. 
O01 B PIC X(25). 
MOVE A(I) TO B. 
are translated by the VAX-11 COBOL V2.0 compiler to: 


INDEX I(R11), #*X0O1, #°X0OF, #*°X19, #*X00, RO 
MOVC3 #°X19, A-25(R11)[RO], B(R11) 


® The FORTRAN statements: 


INTEGER* 4 A(11:24), I 
A(I) = 1 


are translated by the VAX-11 FORTRAN V2.0 compiler to: 


INDEX I(R11), #11, #24, #1, #0, RO 
MOVL #1, A-44(R11){(RO] 


e The PASCAL statements: 


var 
1 : integer; 
a: array[11..24] of integer; 
ali] s:= 1 


are translated by the VAX-11 PASCAL V2.0 compiler to: 


INDEX 1,#11,#24,#1,#0,R0 
MOVZBL #1,A-44[R0] 


INSTRUCTIONS Page 4-82 
Miscellaneous Instructions 


MOVPSL Move from PSL 
Format: 

opcode dst.wl 
Operation: 

dst <- PSL; 


Condition Codes: 


N <- N?3 

Ly. So Be 

V <- V; 

Cc <= Cs 
Exceptions: 

none 
Opcodes: 


DC MOVPSL Move from PSL 


Description: 


The destination operand is replaced by PSL (See Chapter 6). 
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NOP No Operation 
Format: 

opcode 
Operation: 

none 


Condition Codes: 


N <- N; 
ZL <= «Ze 
Ve<-— Ve 
Co <= Ce 
Exceptions: 
none 
Opcodes: 
O01 NOP No Operation 
Description: 


No operation is performed. 
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POPR Pop Registers 
Format: 

opcode mask.rw 
Operation: 


for tmp <- 0 step 1 until 14 do 
if mask<tmp> EQL 1 then R[tmp] <- (SP)+; 


Condition Codes: 


N <- N;3 

G-S = Le 

V <- V; 

C= iC. 
Exceptions: 

none 
Opcodes: 


BA POPR Pop Registers 


Description: 


The contents of registers whose number corresponds to set bits in the mask operand are replaced by 
longwords popped from the stack. R[n] is replaced if mask<n> is set. The mask is scanned from bit 0 to 
bit 14. Bit 15 is ignored. 
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PUSHR Push Registers 
Format: 

opcode mask.rw 
Operation: 


for tmp <- 14 step -1 until 0 do 
if mask<tmp> EQL 1 then -(SP) <- R[tmp]; 


Condition Codes: 


N <- N;3 

Z<- 23 

Ve<=] Ve 

C <= CC: 
Exceptions: 

none 
Opcodes: 


BB PUSHR Push Registers 


Description: 


The contents of registers whose number corresponds to set bits in the mask operand are pushed on the 
stack as longwords. R[{n] is pushed if mask<n> is set. The mask is scanned from bit 14 to bit 0. Bit 15 is 
ignored. 


Notes: 
The order of pushing is specified so that the contents of higher numbered registers are stored at higher 


memory addresses. This results in, say, a quadword datum stored in adjacent registers being stored by 
PUSHR in memory in the correct order. 
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XFC Extended Function Call 
Format: 

opcode 
Operation: 

{XFC fault}; 


Condition Codes: 


N <- 0; 
Z<- 0: 
V <- 0; 
Cc <- 0: 
Exceptions: 
none 
Opcodes: 
FC XFC Extended Function Call 
Description: 


In order to understand the operation of this instruction, it is necessary to read Chapter 6. This instruction 
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provides for customer defined extensions to the instruction set. 
4.8 QUEUE INSTRUCTIONS 


A queue is a circular, doubly linked list. A queue entry is specified by its address. Each queue entry is 
linked to the next via a pair of longwords. The first longword is the forward link : it specifies the location 
of the succeeding entry. The second longword is the backward link : it specifies the location of the preceeding 
entry. 


The VAX-11 supports two distinct types of links : absolute, and self-relative. An absolute link contains the 
absolute address of the entry that it points to. A self-relative link contains a displacement from the present 
queue entry. A queue is classified by the type of link it uses. 


Because a queue contains redundant links, it is possible to create ill-formed queues. The VAX-11 instructions 
produce UNPREDICTABLE results when used on ill-formed queues. 


4.8.1 Absolute Queues 
Absolute queues use absolute addresses as links. Queue entries are linked by a pair of longwords. 


The first (lowest addressed) longword is the forward link: the address of the succeeding queue entry. The 
second (highest addressed) longword is the backward link: the address of the preceding queue entry. A 
queue is specified by a queue header which is identical to a pair of queue linkage longwords. The forward 
link of the header is the address of the entry termed the head of the queue. The backward link of the 
header is the address of the entry termed the tail of the queue. The forward link of the tail points to the 
header. 


Two general operations can be performed on queues: insertion of entries and removal of entries. Generally 
entries can be inserted or removed only at the head or tail of a queue. (Under certain restrictions they can 
be inserted or removed elsewhere; this is discussed later.) 


The following contains examples of queue operations. An empty queue is specified by its header at address 
H: 


3 
1 0 
:H 
>H+4 
3 6) 
1 


If an entry at address B is inserted into an empty queue (at either the head or tail), the queue is as shown 
below: 
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3 0) 
1 
3 
1 6) 
:B 
:Bt4 
3 @) 


If an entry at address A is inserted at the head of the queue, the queue is as shown below: 


3 0) 
1 
3 
1 ) 
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3 
1 0 
3 0 


3 

1 @) 
3 0 
1 

3 

1 0 
3 0 
1 

3 

1 0 
3 0 
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Following the above steps in reverse order gives the effect of removal at the tail and removal at the head. 


lf more than 1 process can perform operations on a queue simultaneously, insertions and removals should 
only be done at the head or tail of the queue. If only 1 process (or 1 process at a time) can perform 
operations on a queue, insertions and removals can be made at other than the head or tail of the queue. 
In the example above with the queue containing entries A,B, and C, the entry at address B can be removed 


giving: 


3 @) 

1 

3 

1 0) 
7A 
:A+4 

3 @) 

1 

3 

1 ) 


The reason for the above restriction is that operations at the head or tail are always valid because the 
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queue header is always present; operations elsewhere in the queue depend on specific entries being present 
and may become invalid if another process is simultaneously performing operations on the queue. 


Two instructions are provided for manipulating absolute queues : INSQUE, and REMQUE. INSQUE inserts 
an entry specified by an entry operand into the queue following the entry specified by the predecessor 
operand. REMQUE removes the entry specified by the entry operand. Queue entries can be on arbitrary 
byte boundaries. Both INSQUE and REMQUE are implemented as non-interruptible instructions. 
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4.8.2 Self-relative Queues 


Self-relative queues use displacements from queue entries as links. Queue entries are linked by a pair of 
longwords. The first longword (lowest addressed) is the forward link : displacement of the succeeding queue 
entry from the present entry. The second longword (highest addressed) is the backward link: the displacement 
of the preceding queue entry from the present entry. A queue is specified by a queue header, which also 
consists of two longword links. 


The following contains examples of queue operations. An empty queue is specified by its header at address 
H. Since the queue is empty, the self-relative links must be zero as shown below: 


m CO 
Lo) 


If an entry at address B is inserted into an empty queue (at either the head or tail), the queue is as shown 
below: 


me GW 


hm W 
© 


m 
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If an entry at address A is inserted at the head of the queue, the queue is as shown below: 
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3 

1 0 
7A 
:At+4 

3 6) 

1 

3 

1 0) 

A - B >B+4 

3 6) 

1 

3 

1 0 

3 0) 

1 


Following the above steps in reverse order gives the effect of removal at the tail and removal at the head. 


Four operations can be performed on self-relative queues : insert at head, insert at tail, remove from head, 
and remove from tail. Furthermore, these operations are interlocked to allow cooperating processes in a 
multiprocessor system to access a shared list without additional synchronization. Queue entries must be 
quadword aligned. Hardware supported interlocked memory access mechanism is used to read the queue 
header. Bit 0 of the queue header is used as a secondary interlock and is set when the queue is being 
accessed. If an interlocked queue instruction encounters the secondary interlock set, it terminates after 
setting the condition codes to indicate failure to gain access to the queue. If the secondary interlock bit is 
not set, then the interlocked queue instruction sets it during its operation and clears it at instruction completion. 
This prevents other interlocked queue instructions from operating on the same queue. 


4.8.3 Instruction Descriptions 
The following instructions are described in this section. 


e Insert Entry into Queue at Head, Interlocked 
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INSQHI entry.ab, header.aq 


e Insert Entry into Queue at Tail, Interlocked 
INSQTI entry.ab, header.aq 


° Insert Entry in Queue 
INSQUE entry.ab, pred.ab 


° Remove Entry from Queue at Head, Interlocked 
REMQHI header.aq, addr.wl 


e Remove Entry from Queue at Tail, Interlocked 
REMQTI header.aq, addr.wl 


e Remove Entry from Queue 
REMQUE entry.ab, addr.wl 
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INSQHI Insert Entry into Queue at Head, Interlocked 
Format: 

opcode entry.ab, header.aq 
Operation: 


{must have write access to header. 
{header must be quadword aligned. 
t!header cannot be equal to entry. 
tmpl <- (header) {interlocked}; !acquire hardware interlock. 
f!tmpl<2:1> must be zero. 


if tmpl<0> EQLU 1 then 
begin 
(header) {interlocked} <- tmpl;!release hardware interlock 
{set condition codes and terminate instruction}; 
end; 
else 
begin 
(header) {interlocked} <- tmpl v 1;!set secondary interlock 
!release hardware interlock 
If {all memory accesses can be completed} then 
!check 1f following addresses can be written 
{without cauSing a memory management exception: 
: entry 
! header + tmpl 
!Also, check for quadword alignment 
begin 
{insert entry into queue}; 
{release secondary interlock}; 
end; 
else 
begin 
{release secondary interlock}; 
{backup instruction}; 
{initiate fault}; 
end; 
end; 
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Condition Codes: 


if {insertion succeeded} then 


begin 
N <- Q; 
Z <- (entry) EQL (entry+4); !first entry in queue 
V <- OQ; 
C <- 0; 
end; 
else 
begin 
N <- 0; 
Z, <=: 0% 
V <- 0; 
C <- 1; {secondary interlock failed 
end; 


Exceptions: 
reserved operand 
Opcodes: 
5C INSQHI Insert Entry into Queue at Head, Interlocked 
Description: 


The entry specified by the entry operand is inserted into the queue following the header. If the entry inserted 
was the first one in the queue, the condition code Z-bit is set; otherwise it is cleared. The insertion is a 
non-interruptible operation. The insertion is interlocked to prevent concurrent interlocked insertions or removals 
at the head or tail of the same queue by another process even in a multiprocessor environment. Before 
performing any part of the operation, the processor validates that the entire operation can be completed. 
This ensures that if a memory management exception occurs (See Chapters 5 and 6), the queue is left in 
a consistent state. If the instruction fails to acquire the secondary interlock, the instruction sets condition 
codes and terminates. 
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Notes: 


e Because the insertion is non-interruptible, processes running in kernel mode can share queues 
with interrupt service routines (See Chapters 5, 6, and 7). 


e The INSQHI, INSQTI, REMQHI, and REMQTI instructions are implemented such that cooperating 
software processes in a multiprocessor may access a shared list without additional 
synchronization. 


e To set a software interlock realized with a queue, the following can be used: 
INSERT : INSQHI ... ;wasS queue empty? 
BEQL 1$ ;yes 
BCS INSERT stry inserting again 
CALL WAIT(...) sno, wait 
LS: 
e During access validation, any access which cannot be completed results in a memory 


management exception even though the queue insertion is not started. 


e A reserved operand fault occurs if entry or header is an address that is not quadword aligned 
(i.e. <2:0> NEQU 0) or if (header)<2:1> is not zero. A reserved operand fault also occurs if 
header equals entry. In this case the queue is not altered. 
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INSQTI Insert Entry into Queue at Tail, Interlocked 
Format: 

opcode entry.ab, header.aq 
Operation: 


{must have write access to header. 
!header must be quadword aligned. 
!theader cannot be equal to entry. 
tmpl <- (header) {interlocked}; !acquire hardware interlock. 
{tmpl<2:1> must be zero. 


1f tmpl<0> EQLU 1 then 
begin 
(header) {interlocked} <- tmpl;!release hardware interlock 
{set condition codes and terminate instruction}; 
end; 
else 
begin 
(header) {interlocked} <- tmpl v l;!set secondary interlock 
'release hardware interlock 
If {all memory accesses can be completed} then 
{check if the following addresses can be written 
{without cauSing a memory management exception: 
! entry 
! header + (header + 4) 
!Also, check for quadword alignment 
begin 


{insert entry into queue}; 
{release secondary interlock}; 


end: 
else 
begin 


{release secondary interlock}; 


{backup instruction}; 
{initiate fault}; 
end; 

end; 
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Condition Codes: 


if {insertion succeeded} then 


begin 
N <- Q; 
Z<- (entry) EQL (entry+4); !'first entry in queue 
V <- QO; 
C <- Q; 
end: 
else 
begin 
N <- QO; 
Z<- 0: 
V <- O; 
C <- ls: {secondary interlock failed 
end; 


Exceptions: 
reserved operand 
Opcodes: 


5D INSQTI Insert Entry into Queue at Tail, Interlocked 


Description: 


The entry specified by the entry operand is inserted into the queue preceding the header. If the entry 
inserted was the first one in the queue, the condition code Z-bit is set; otherwise it is cleared. The insertion 
is a non-interruptible operation. The insertion is interlocked to prevent concurrent interlocked insertions or 
removals at the head or tail of the same queue by another process even in a multiprocessor environment. 
Before performing any part of the operation, the processor validates that the entire operation can be 
completed. This ensures that if a memory management exception occurs (See Chapters 5 and 6), the queue 
is left in a consistent state. If the instruction fails to acquire the secondary interlock, the instruction sets 
condition codes and terminates. 
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Notes: 


e Because the insertion is non-interruptible, processes running in kernel mode can share queues 
with interrupt service routines (See Chapters 5, 6, and 7). 


° The INSQHI, INSQTI, REMQHI, and REMQTI instructions are implemented such that cooperating 
software processes in a multiprocessor may access a shared list without additional 
synchronization. 


e To set a software interlock realized with a queue, the following can be used: 
INSERT: INSQHI  ... s;was queue empty? 
BEQL 1$ ;yes 
BCS INSERT stry inserting again 
CALL WAIT(...) sno, wait 
LS 
e During access validation, any access which cannot be completed results in a memory 


management exception even though the queue insertion is not started. 


e A reserved operand fault occurs if entry, header, or (header+4) is an address that is not 
quadword aligned (i.e. <2:0> NEQU 0) or if (header)<2:1> is not zero. A reserved operand 
fault also occurs if header equals entry. In this case the queue is not altered. 
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INSQUE Insert Entry in Queue 
Format: 

opcode entry.ab, pred.ab 
Operation: 


If {all memory accesses can be completed} then 


begin 
(entry) <- (pred); !forward link of entry 
(entry + 4) <- pred; tbackward link of entry 
((pred) + 4) <- entry; !backward link of successor 
(pred) <- entry; !forward link of predecessor 
end; 

else 
begin 


{backup instruction}; 
{initiate fault}; 
end; 


Condition Codes: 


N <- (entry) LSS (entry+4); 
Z <- (entry) EQL (entry+4); !'first entry in queue 
: “ — LSSU (entry+4); 
Exceptions: 
none 
Opcodes: 
OE INSQUE Insert Entry in Queue 
Description: 


The entry specified by the entry operand is inserted into the queue following the entry specified by the 
predecessor operand. If the entry inserted was the first one in the queue, the condition code Z-bit is set; 
otherwise it is cleared. The insertion is a non-interruptible operation. Before performing any part of the 
operation, the processor validates that the entire operation can be completed. This ensures that if a memory 
management exception occurs (See Chapters 5 and 6), the queue is left in a consistent state. 
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Notes: 
e Three types of insertion can be performed by appropriate choice of predecessor operand: 
1 Insert at head 
INSQUE entry,h sh 1S queue head 
2. Insert at tail 
INSQUE entry,@h+t+4 sh 1s queue head 


(Note "@" in this case only) 


3. Insert after arbitrary predecessor 
INSQUE entry,p 7p 1S predecessor 
e Because the insertion is non-interruptible, processes running in kernel mode can share queues 


with interrupt service routines (See Chapters 5, 6, and 7). 


° The INSQUE and REMQUE instructions are implemented such that cooperating software 
processes in a single processor may access a shared list without additional synchronization if 
the insertions and removals are only at the head or tail of the queue. 


° To set a software interlock realized with a queue, the following can be used: 
INSQUE ... s;was queue empty? 
BEQL 1$ ;yes 
CALL WAIT (ead) sno, wait 
1S: 
e During access validation, any access which cannot be completed results in a memory 


management exception even though the queue insertion is not started. 


INSTRUCTIONS Page 4-104 
Queue Instructions 


REMQHI Remove Entry from Queue at Head, Interlocked 
Format: 

opcode header.aq, addr.wl 
Operation: 


{must have write access to header. 
!header must be quadword aligned. 
!header cannot equal address of addr. 
tmpl <- (header) {interlocked}; !acquire hardware interlock. 
{tmpl<2:1> must be zero. 


if tmpl<0> EQLU 1 then 
begin 
(header) {interlocked} <- tmpl;!release hardware interlock 
{set condition codes and terminate instruction}: 
end; 
else 
begin 
(header) {interlocked} <- tmpl v 1;!set secondary interlock 
!release hardware interlock 
If {all memory accesses can be completed} then 
!check if the following can be done without 
{causing a memory management exception: 
!write addr operand 
{read contents of header + tmpl {if tmpl NEQU 0} 
{write into header + tmpl + (header + tmpl1) 
! {if tmpl NEQU 0} 
!Also, check for quadword alignment 
begin 


{remove entry from queue}; 
{release secondary interlock}; 


end; 
else 
begin 
{release secondary interlock}; 
{backup instruction}; 
{initiate fault}; 
end; 
end; 
Condition Codes: 


if {removal succeeded} then 
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begin 

N <- 0; 

Z<- (header) EQL 0; !queue empty after removal 

V <- {queue empty before this instruction}; 

C <- 0; 

end; 
else 

begin 

N <- 

Z<- 

V <- 

Css 

end; 


{did not remove anything 
!secondary interlock failed 


Hr OO 


=e “eo WO NO 


Exceptions: 


reserved operand 


Opcodes: 


5E REMQHI Remove Entry from Queue at Head, Interlocked 


Description: 


If the secondary interlock is clear, the queue entry following the header is removed from the queue and 
the address operand is replaced by the address of the entry removed. If the queue was empty prior to this 
instruction or if the secondary interlock failed, the condition code V bit is set; otherwise it is cleared. 


If the interlock succeeded and the queue is empty at the end of this instruction, the condition code Z-bit 
is set; otherwise it is cleared. The removal is interlocked to prevent concurrent interlocked insertions or 
removals at the head or tail of the same queue by another process even in a multiprocessor environment. 
The removal is a non-interruptible operation. Before performing any part of the operation, the processor 
validates that the entire operation can be completed. This ensures that if a memory management exception 
occurs (See Chapters 5 and 6), the queue is left in a consistent state. If the instruction fails to acquire the 
secondary interlock, the instruction sets condition codes and terminates without altering the queue. 


Notes: 
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Because the removal is non-interruptible, processes running in kernel mode can share queues 
with interrupt service routines (See Chapters 5, 6, and 7). 


The INSQHI, INSQTI, REMQHI, and REMQTI instructions are implemented such that cooperating 
software processes in a multiprocessor may access a shared list without additional 
synchronization. 


To release a software interlock realized with a queue, the following can be used: 


1S: REMQHI  ... *removed last? 
BEQL 25S 7yes 
BCS 1s stry removing again 
CALL ACTIVATE(...) sActivate other waiters 
25% 


To remove entries until the queue is empty, the following can be used: 


Ls: REMQHI ... sanything removed? 
BVS 2$ -no 


process removed entry 


BR 1$ F 


28:3 BCS 1$ ;try removing again 
queue empty 


During access validation, any access which cannot be completed results in a memory 
management exception even though the queue removal is not started. 


A reserved operand fault occurs if header or (header + (header)) is an address that is not 
quadword aligned (i.e. <2:0> NEQU 0) or if (header)<2:1> is not zero. A reserved operand 
fault also occurs if the header address operand equals the address of the addr operand. In 
this case the queue is not altered. 
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REMQTI Remove Entry from Queue at Tail, Interlocked 
Format: 

opcode header.aq, addr.wl 
Operation: 


{must have write access to header. 
!header must be quadword aligned. 
!header cannot equal address of addr. 
tmpl <- (header){interlocked}; !acquire hardware interlock. 
{!tmpl<2:1> must be zero. 


if tmpl<0> EQLU 1 then 
begin 
(header) {interlocked} <- tmpl;!release hardware interlock 
{set condition codes and terminate instruction}; 
end; 
else 
begin 
(header) {interlocked} <- tmpl v 1;!set secondary interlock 
{release hardware interlock 
If {all memory accesses can be completed} then 
{check if the following can be done without 
!causing a memory management exception ; 
{write addr operand 
!'read contents of header + (header + 4) 
! {if tmpl NEQU 0} 
!write into header + (header + 4) 
! + (header + 4 + (header + 4)) {if tmpl NEQU 0} 
!Also, check for quadword alignment 
begin 


{remove entry from queue}; 
{release secondary interlock}; 


end; 
else 
begin 


{release secondary interlock}; 


{backup instruction}; 
{initiate fault}; 
end; 

end; 


INSTRUCTIONS Page 4-108 
Queue Instructions 


Condition Codes: 
if {removal succeeded} then 
begin 
N <- QO; 
Z<- (header + 4) EQL 0;!queue empty after removal 
V <- {queue empty before this instruction}; 


C <= :.05 
end; 
else 

begin 
N <- 0; 
Z<- Q;3 
V <- 1; !did not remove anything 
C <- l; {secondary interlock failed 
end; 

Exceptions: 


reserved operand 


Opcodes: 


SF REMQTI Remove Entry from Queue at Tail, Interlocked 


Description: 


If the secondary interlock is clear, the queue entry preceding the header is removed from the queue and 
the address operand is replaced by the address of the entry removed. If the queue was empty prior to this 
instruction or if the secondary interlock failed, the condition code V bit is set; otherwise it is cleared. 


If the interlock succeeded and the queue is empty at the end of this instruction, the condition code Z-bit 
is set; otherwise it is cleared. The removal is interlocked to prevent concurrent interlocked insertions or 
removals at the head or tail of the same queue by another process even in a multiprocessor environment. 
The removal is a non-interruptible operation. Before performing any part of the operation, the processor 
validates that the entire operation can be completed. This ensures that if a memory management exception 
occurs (See Chapters 5 and 6), the queue is left in a consistent state. If the instruction fails to acquire the 
secondary interlock, the instruction sets condition codes and terminates without altering the queue. 


Notes: 
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Because the removal is non-interruptible, processes running in kernel mode can share queues 
with interrupt service routines (See Chapters 5, 6, and 7). 


The INSQHI, INSQTI, REMQHI, and REMQTI instructions are implemented such that cooperating 
software processes in a multiprocessor may access a _ shared list without additional 
synchronization. 


To release a software interlock realized with a queue, the following can be used: 


1s: REMQTI ... *removed last? 
BEQL 2$ 7yes 
BCS 1$ stry removing again 


CALL ACTIVATE(...) *Activate other waiters 


25% 


To remove entries until the queue is empty, the following can be used: 


1S: REMQTI ... sanything removed? 
BVS 2$ sno 


process removed entry 


BR 1S ; 


Z>% BCS 1$ ;try removing again 
queue empty 


During access validation, any access which cannot be completed results in a memory 
management exception even though the queue removal is not started. 


A reserved operand fault occurs if header, (header + 4), or (header + (header + 4)+4) is 
an address that is not quadword aligned (i.e. <2:0> NEQU 0) or if (header)<2:1> is not zero. 
A reserved operand fault also occurs if the header address operand equals the address of the 
addr operand. In this case the queue is not altered. 
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REMQUE Remove Entry From Queue 
Format: 

opcode entry.ab,addr.wl 
Operation: 


if {all memory acceses can be completed} then 
begin 


((entry+4)) <- (entry); !forward link of predecessor 
((entry)+4) <- (entry +4);!backward link of successor 
addr <- entry; 
end: 
else 
begin 
{backup instruction}; 
{initiate fault}: 
end; 


Condition Codes: 


N <- (entry) LSS (entry+4); 
Z<- (entry) EQL (entry+4); !queue empty 
V <- entry EQL (entry+4); !no entry to remove 
C <- (entry) LSSU (entry+4); 
Exceptions: 
none 
Opcodes: 
OF REMQUE Remove Entry from Queue 
Description: 


The queue entry specified by the entry operand is removed from the queue. The address operand is 
replaced by the address of the entry removed. If there was no entry in the queue to be removed, the 
condition code V bit is set; otherwise it is cleared. If the queue is empty at the end of this instruction, the 
condition code Z-bit is set; otherwise it is cleared. The removal is a non-interruptible operation. Before 
performing any part of the operation, the processor validates that the entire operation can be completed. 
This ensures that if a memory management exception occurs (See Chapters 5 and 6), the queue is left in 
a consistent state. 
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Notes: 
° Three types of removal can be performed by suitable choice of entry operand: 
1. Remove at head 
REMQUE @h,addr sh 1S queue header 
2. Remove at tail 
REMQUE @h+4,addr ;h 1S queue header 
3. Remove arbitrary entry 
REMQUE entry,addr ; 
° Because the removal is non-interruptible, processes running in kernel mode can share queues 


with interrupt service routines (See Chapters 5, 6, and 7). 


° The INSQUE and REMQUE instructions are implemented such that cooperating software 
processes in a single processor may access a shared list without additional synchronization if 
the insertions and removals are only at the head or tail of the queue. 


e To release a software interlock realized with a queue, the following can be used: 
REMQUE ... ;queue empty? 
BEQL 1$ ;yes 
CALL ACTIVATE(...) *Activate other waiters 
is: 
e To remove entries until the queue is empty, the following can be used: 
1S; REMQUE ... sanything removed? 
BVS EMPTY -no 
BR 1$ ; 
e During access validation, any access which cannot be completed results in a memory 


management exception even though the queue removal is not started. 
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4.9 FLOATING POINT INSTRUCTIONS 


The floating point instructions operate on four data types. F_floating and D_floating instructions are standard 
on all VAX processors. G_floating and H_floating instructions are optional on the VAX-11/780 and the 
VAX-11/750; standard on the VAX-11/730. The microVAX architecture only includes floating point instructions 
that operate on F_floating and G_floating (see Appendix B). These instructions may be optional in some 
implementations of the microVAX architecture. 


4.9.1 Representation 


Mathematically, a floating point number may be defined as having the form 
(+ or -) (2**K)*f£, 


where K is an integer and f is a non-negative fraction. For a non-vanishing number, K and f are uniquely 
determined by imposing the condition 


1/2 LEQ f LSS l. 


The fractional factor, f, of the number is then said to be binary normalized. For the number zero, f must 
be assigned the value 0, and the value of K is indeterminate. 


The VAX floating point data formats are derived from this mathematical representation for floating point 
numbers. Four types of floating point data are provided : the two standard PDP-11 formats (F_floating and 
D_ floating), and two extended range formats (G_floating and H_floating). Single precision, or floating, data 
is 32 bits long. Double precision, or D_floating, data is 64 bits long. Extended range double precision, or 
G_floating, data is 64 bits long. Extended range quadruple precision, or H_floating, data is 128 bits long. 
Sign magnitude notation is used. 


4.9.1.1 Non-zero Floating Point Numbers - 
The most significant bit of the floating point data is the sign bit: O for positive, and 1 for negative. 


The fractional factor f is assumed normalized, so that its most significant bit must be 1. This 1 is the 
"hidden" bit: it is not stored in the data word, but of course the hardware restores it before carrying out 
arithmetic operations. The F_floating and D_floating data types use 23 and 55 bits, respectively, for f, 
which with the hidden bit, imply effective significance of 24 bits and 56 bits for arithmetic operations. The 
extended range data types, G_floating and H_floating, use 52 and 112 bits, respectively, for f, which with 
the hidden bit, imply effective significance of 53 and 113 bits for arithmetic operations. 


In the F_floating and D_floating data types, eight bits are reserved for the storage of the exponent K in 
excess 128 notation. Thus exponents from -128 to +127 could be represented, in biased form, by 0 to 
255. For reasons given below, a biased EXP of 0 (true exponent of -128), is reserved for floating point 
zero. Thus, for the F_floating and D_floating data types, exponents are restricted to the range -127 to 
+127 inclusive, or in excess 128 notation, 1 to 255. 
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In the G_floating data type eleven bits are reserved for the storage of the exponent in excess 1024 notation. 
Thus, exponents are restricted to -1023 to +1023 inclusive (in excess notation, 1 to 2047). In the H_floating 
data type fifteen bits are reserved for the storage of the exponent in excess 16384 notation. Thus, exponents 
are restricted to -16383 to +16383 inclusive (in excess notation, 1 to 32767). A biased exponent of 0 is 
reserved for floating point zero. 


4.9.1.2 Floating Point Zero - 


Because of the hidden bit, the fractional factor is not available to distinguish between zero and non-zero 
numbers whose fractional factor is exactly 1/2. Therefore VAX reserves a sign-exponent field of O for this 
purpose. Any positive floating point number with biased exponent of 0 is treated as if it were an exact 0 
by the floating point instruction set. In particular, a floating point operand, whose bits are all 0’s, is treated 
as zero, and this is the format generated by all floating point instructions for which the result is zero. 


4.9.1.3 Reserved Operands - 


A reserved operand is defined to be any bit pattern with a sign bit of one and a biased exponent of zero. 
On the VAX, all floating point instructions generate a fault if a reserved operand is encountered. A reserved 
operand is never generated as a result of a floating point instruction. 


4.9.2 Overview Of The Instruction Set 


VAX has the standard arithmetic operations ADD, SUB, MUL, and DIV implemented for all four floating data 
types. The results of these operations are always rounded, as described in the section on accuracy. It has, 
in addition, two composite operations, EMOD and POLY, also implemented for all four floating point data 
types. EMOD generates a product of two operands, and then separates the product into its integer and 
fractional terms. POLY evaluates a polynomial, given the degree, the argument and pointer to a table of 
coefficients. Details on the operation of EMOD and POLY are given in their respective descriptions. All of 
these instructions are subject to the rounding errors associated with floating point operations, as well as to 
exponent overflow and underflow. Accuracy is discussed in the next section, and exceptions are discussed 
in Chapter 6. 


VAX also has a complete set of instructions for conversion from integer arithmetic types (byte, word, 
longword) to all floating types (F_floating, D_floating, G_floating, H_floating), and vice versa. VAX also has 
a set of instructions for conversion between all of the floating types except between D_floating and G_ floating. 
Many of these instructions are exact, in the sense defined in the section on accuracy to follow. However, 
a few may generate rounding error, floating overflow, floating underflow, or induce integer overflow. Details 
are given in the description of the CVT instructions. 


There is a class of move-type instructions which are always exact: MOV, NEG, CLR, CMP, and TST. And, 
finally, there is the ACB (add, compare and branch) instruction, which is subject to rounding errors, overflow 
and underflow. 


All of the VAX floating point instructions fault if a reserved operand is encountered. Floating point instructions 
also fault on the occurrence of floating overflow or divide by zero. The FU bit, in the PSW, is available 
to enable or disable an exception on underflow. If the FU bit is clear, no exception occurs on underflow 
and zero is returned as the result. If the FU bit is set, a fault occurs on underflow. Further details on the 
actions taken if any of these exceptions occurs are included in the descriptions of the instructions, and 
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completely discussed in Chapter 6. 


4.9.3 Accuracy 


General comments on the accuracy of the VAX floating point instruction set are presented here. The 
descriptions of the individual instructions may include additional details on the accuracy at which they operate. 


An instruction is defined to be exact if its result, extended on the right by an infinite sequence of zeroes, 
is identical to that of an infinite precision calculation involving the same operands. The a priori accuracy of 
the operands is thus ignored. For all arithmetic operations, except DIV, a zero operand implies that the 
instruction is exact. The same statement holds for DIV if the zero operand is the dividend. But if it is the 
divisor, division is undefined and the instruction faults. 


For non-zero floating point operands, the fractional factor is binary normalized with 24 or 56 bits for single 
precision (F_floating) or double precision (D_floating), respectively; and 53 or 113 bits for extended range 
double precision (G_floating), and extended range quadruple precision (H _floating), respectively. 


Note that an arithmetic result is exact if no non-zero bits are lost in chopping the infinite precision result 
to the data length to be stored. Chopping is defined to mean that the 24 (F_floating), 56 (D_floating), or 
53 (G_floating) or 113 (H_floating) high order bits of the normalized fractional factor of a result are stored; 
the rest of the bits are discarded. The first bit lost in chopping is referred to as the "rounding" bit. The 
value of a rounded result is related to the chopped result as follows: 


e If the rounding bit is one, the rounded result is the chopped result incremented by an LSB 
(least significant bit). 


e If the rounding bit is zero, the rounded and chopped results are identical. 
All VAX processors implement rounding so as to produce results identical to the results produced by the 
following algorithm. Add a 1 to the rounding bit, and propagate the carry, if it occurs. Note that a 
renormalization may be required after rounding takes place; if this happens, the new rounding bit will be 
zero, so it can happen only once. The following statements summarize the relations among chopped, rounded 
and true (infinite precision) results: 


® If a stored result is exact 


rounded value = chopped value = true value. 


e If a stored result is not exact, it’s magnitude 
A is always less than that of the true result for chopping. 
2. is always less than that of the true result for rounding if the rounding bit is zero. 


3. is greater than that of the true result for rounding if the rounding bit is one. 
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4.9.4 Programming Considerations 


In order to be consistent with the floating point instruction set which faults on reserved operands, software 
implemented floating point functions (e.g., the absolute function) should verify that the input operand(s) is 
(are) not reserved. An easy way to do this is a floating move or test of the input operand(s). 


In order to facilitate high speed implementations of the floating point instruction set, certain restrictions are 
placed on the addressing mode combinations usable within a single floating point instruction. These 
combinations involve the logically inconsistent simultaneous use of a value as both a floating point operand 
and an address. Specifically, if within the same instruction the contents of register Rn is used as both a 
part of a floating point input operand (i.e., a .rf, .rd, .rg, .rh, .mf, .md, .mg, or .mh operand) and as an 
address in an addressing mode which modifies Rn (i.e., autoincrement, autodecrement, or autoincrement 
deferred), the value of the floating point operand is UNPREDICTABLE. 
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4.9.5 Instruction Descriptions 


The following instructions are described in this section. 


° Add 2 Operand 
ADD{F,D,G,H}2 add.rx, sum.mx 


e Add 3 Operand 
ADD{F,D,G,H}3 add1.rx, add2.rx, sum.wx 


e Clear 
CLR{L=F,Q=D=G,0O=H} dst.wx 


° Compare 
CMP{F,D,G,H} srci.rx, src2.rx 


e Convert 
CVT{F,D,G,H}{B,W,L,F,D,G,H} sre.rx, dst.wy 
CVT{B,W,L}{F,D,G,H} sre.rx, dst.wy 
All pairs except FF,DD,GG,HH,DG, and GD 


e Convert Rounded 
CVTR{F,D,G,H}L src.rx, dst.wl 


e Divide 2 Operand 
DIV{F,D,G,H}2 divr.rx, quo.mx 


e Divide 3 Operand 
DIV{F,D,G,H}3 divr.rx, divd.rx, quo.wx 


e Extended Modulus 
EMOD{F,D} mulr.rx, mulrx.rb, muld.rx, int.wl, fract.wx 
EMOD{G,H} mulr.rx, mulrx.rw, muld.rx, int.wl, fract.wx 


e Move Negated 
MNEG{F,D,G,H} sre.rx, dst.wx 


e Move 
MOV{F,D,G,H} src.rx, dst.wx 


e Multiply 2 Operand 
MUL{F,D,G,H}2 mulr.rx, prod.mx 


° Multiply 3 Operand 
MUL{F,D,G,H}3 mulr.rx, muld.rx, prod.wx 


e Polynomial Evaluation F_floating 
POLYF arg.rf, degree.rw, tbladdr.ab, {RO-3.wl} 
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e Polynomial Evaluation D_ floating 
POLYD arg.rd, degree.rw, tbladdr.ab, {RO-5.wl} 


e Polynomial Evaluation G_floating 
POLYG arg.rg, degree.rw, tbladdr.ab, {RO-5.wl} 


° Polynomial Evaluation H _floating 
POLYH arg.rh, degree.rw, tbladdr.ab, {RO-5.wl,-16(SP):-1(SP).wb} 


e Subtract 2 Operand 
SUB{F,D,G,H}2 sub.rx, dif.mx 


° Subtract 3 Operand 
SUB{F,D,G,H}3 sub.rx, min.rx, dif.wx 


e Test 
TST{F,D,G,H} sre.rx 
The following floating point instructions are described in the section on Control Instructions. 
° Add Compare and Branch 


ACB{F,D,G,H} limit.rx, add.rx, index.mx, displ.bw 
Compare is LE on positive add, GE on negative add. 
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ADD Add 
Format: 
opcode add.rx, sum.mx 2 operand 
opcode addl.rx, add2.rx, sum.wx 3 operand 
Operation: 
sum <- sum + add; !2 operand 
sum <- addl + add2; !3 operand 


Condition Codes: 


N <- sum LSS 0; 

Z <- sum EQL QO; 

V <- 0: 

Cc <- 0; 
Exceptions: 


floating overflow 
floating underflow 
reserved operand 


Opcodes: 
40 ADDF2 Add F floating 2 Operand 
41 ADDF3 Add F floating 3 Operand 
60 ADDD2 Add D floating 2 Operand 
61 ADDD3 Add D floating 3 Operand 
40FD ADDG2 ADD G floating 2 Operand 
41FD ADDG3 ADD G floating 3 Operand 
60FD ADDH2 ADD H floating 2 Operand 
61FD ADDH3 ADD H floating 3 Operand 


Description: 

In 2 operand format, the addend operand is added to the sum operand and the sum operand is replaced 
by the rounded result. In 3 operand format, the addend 1 operand is added to the addend 2 operand and 
the sum operand is replaced by the rounded result. 


Notes: 


e On a reserved operand fault, the sum operand is unaffected and the condition codes are 
UNPREDICTABLE. 
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e On floating underflow, if FU is set a fault occurs. Zero is stored as the result of floating 
underflow only if FU is clear. On a floating underflow fault, the sum operand is unaffected. If 
FU is clear, the sum operand is replaced by O and no exception occurs. 


e On floating overflow, the instruction faults; the sum operand is unaffected, and the condition 
codes are UNPREDICTABLE. 
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CLR Clear 
Format: 
opcode dst.wx 
Operation: 
dst <- 0; 


Condition Codes: 


N <- 0; 

Ge iS es 

V <- OQ; 

C.-< ICs 
Exceptions: 

none 
Opcodes: 


D4 CLRF Clear F floating 
7C CLRG Clear G floating, 

CLRD Clear D floating 
7CFD CLRH Clear H floating 


Description: 
The destination operand is replaced by 0. 
Notes: 


CLRx dst is equivalent to MOV x #0, dst, but is 5 (F_floating) or 9 (D_floating or G_floating) or 17 (H _floating) 
bytes shorter. 
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CMP Compare 
Format: 

opcode srcl.rx, src2.rx 
Operation: 

Ssrcl. = srcz;: 


Condition Codes: 


N <- srcl LSS src2; 
Z<- srcl EQL src2; 
V <- Q; 
C <- 0: 


Exceptions: 
reserved operand 
Opcodes: 
51 CMPF Compare F floating 
71 CMPD Compare D floating 


51FD CMPG Compare G floating 
71FD CMPH Compare H floating 


Description: 


The source 1 operand is compared with the source 2 operand. The only action is to affect the condition 
codes. 


Notes: 


On a reserved operand fault, the condition codes are UNPREDICTABLE. 
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CVT Convert 
Format: 

opcode src.rx, dst.wy 
Operation: 

dst <- conversion of src; 
Condition Codes: 


N <- dst LSS 0; 
Z <- dst EQL 0; 


Exceptions: 


integer overflow 
floating overflow 
floating underflow 
reserved operand 


Opcodes: 
4C CVTBF Convert Byte to F floating 
4D CVTWF Convert Word to F floating 
4E CVTLF Convert Long to F floating 
6C CVTBD Convert Byte to D floating 
6D CVTWD Convert Word to D floating 
6E CVTLD Convert Long to D floating 
4CFD CVTBG Convert Byte to G floating 
4DFD CVTWG Convert Word to G floating 
4EFD CVTLG Convert Long to G floating 
6CFD CVTBH Convert Byte to H floating 
6DFD CVTWH Convert Word to H floating 
6EFD CVTLH Convert Long to H floating 
48 CVTFB Convert F floating to Byte 
49 CVTFW Convert F floating to Word 
4A CVTFL Convert F floating to Long 
4B CVTRFL Convert Rounded F floating 
68 CVTDB Convert D floating to Byte 
69 CVTDW Convert D floating to Word 


to Long 
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6A CVTDL Convert D floating to Long 

6B CVTRDL Convert Rounded D floating to Long 
48FD CVTGB Convert G floating to Byte 

49FD CVTGW Convert G floating to Word 

4AFD CVTGL Convert G floating to Long 

4BFD CVTRGL Convert Rounded G floating to Long 
68FD CVTHB Convert H floating to Byte 

69FD CVTHW Convert H floating to Word 

6AFD CVTHL Convert H floating to Long 

6BFD CVTRHL Convert Rounded H floating to Long 
56 CVTFD Convert F floating to D floating 
99FD CVTFG Convert F floating to G floating 
98FD CVTFH Convert F floating to H floating 
76 CVTDF Convert D floating to F floating 
32FD CVTDH Convert D floating to H floating 
33FD CVTGF Convert G floating to F floating 
56FD CVTGH Convert G floating to H floating 
F6FD CVTHF Convert H floating to F floating 
F7FD CVTHD Convert H floating to D floating 
76FD CVTHG Convert H floating to G floating 

Description: 


The source operand is converted to the data type of the destination operand and the destination operand 
is replaced by the result. The form of the conversion is as follows: 


CVTBF exact 
CVTBD exact 
CVTBG exact 
CVTBH exact 
CVTWF exact 
CVTWD exact 
CVTWG exact 
CVTWH exact 
CVTLF rounded 
CVTLD exact 
CVTLG exact 
CVTLH exact 
CVTFB' truncated 
CVTDB' truncated 
CVTGB truncated 
CVTHB truncated 
CVTFW truncated 
CVTDW truncated 
CVTGW truncated 
CVTHW truncated 
CVTFL truncated 


Notes: 
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CVTRFL rounded 
CVTDL truncated 
CVTRDL rounded 
CVTGL truncated 
CVTRGL rounded 
CVTHL truncated 
CVTRHL rounded 


CVTFD exact 
CVTFG exact 
CVTFH exact 
CVTDF rounded 
CVTDH exact 
CVTGF rounded 
CVTGH exact 
CVTHF rounded 
CVTHD rounded 
CVTHG rounded 


° Only CVTDF, CVTGF, CVTHF, CVTHD, and CVTHG can result in floating overflow fault; the 
destination operand is unaffected and the condition codes are UNPREDICTABLE. 


e Only converts with a floating point source operand can result in a reserved operand fault. On 
a reserved operand fault, the destination operand is unaffected and the condition codes are 
UNPREDICTABLE. 

e Only converts with an integer destination operand can result in integer overflow. On integer 


overflow, the destination operand is replaced by the low order bits of the true result. 


e Only CVTGF, CVTHF, CVTHD, and CVTHG can result in floating underflow. If FU is set a 
fault occurs. Zero is stored as the result of floating underflow only if FU is clear. On a floating 
underflow fault, the destination operand is unaffected. If FU is clear, the destination operand 
is replaced by 0 and no exception occurs. 
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DIV Divide 
Format: 
opcode divr.rx, quo.mx 2 operand 
opcode divr.rx, divd.rx, quo.wx 3 operand 
Operation: 
quo <- quo / divr; !2 operand 
quo <- divd / divr; !3 operand 


Condition Codes: 


N <- quo LSS 0; 

Z<- quo EQL 0; 

V <- 0; 

Cc <- 0; 
Exceptions: 


floating overflow 
floating underflow 
divide by zero 
reserved operand 


Opcodes: 
46 DIVF2 Divide F floating 2 Operand 
47 DIVF3 Divide F floating 3 Operand 
66 DIVD2 Divide D floating 2 Operand 
67 DIVD3 Divide D floating 3 Operand 
46FD DIVG2 Divide G floating 2 Operand 
47FD DIVG3 Divide G floating 3 Operand 
66FD DIVH2 Divide H floating 2 Operand 
67FD DIVH3 Divide H floating 3 Operand 


Description: 


In 2 operand format, the quotient operand is divided by the divisor operand and the quotient operand is 
replaced by the rounded result. In 3 operand format, the dividend operand is divided by the divisor operand 
and the quotient operand is replaced by the rounded result. 
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Notes: 
e On a reserved operand fault, the quotient operand is unaffected and the condition codes are 
UNPREDICTABLE. 
e On floating underflow, if FU is set a fault occurs. Zero is stored as the result of floating 
underflow only if FU is clear. On a floating underflow fault, the quotient operand is unaffected. 
If FU is clear, the quotient operand is replaced by O and no exception occurs. 
e On floating overflow, the instruction faults; the quotient operand is unaffected, and the condition 


codes are UNPREDICTABLE. 


e On divide by zero, the quotient operand and condition codes are affected as in 3. above. 
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EMOD Extended Multiply and Integerize 
Format: 
EMODF and EMODD: 

opcode mulr.rx, mulrx.rb, muld.rx, int.wl, fract.wx 
EMODG and EMODH: 

opcode mulr.rx, mulrx.rw, muld.rx, int.wl, fract.wx 
Operation: 


int <- integer part of muld * {mulr'mulrx}; 
fract <- fractional part of muld * {mulr'mulrx}; 


Condition Codes: 


N <- fract LSS 0; 

Z<- fract EQL 0; 

v <- {integer overflow}; 
C <- 0; 


Exceptions: 


integer overflow 
floating underflow 
reserved operand 


Opcodes: 
54 EMODF Extended Multiply and Integerize F floating 
74 EMODD Extended Multiply and Integerize D_ floating 


54FD EMODG Extended Multiply and Integerize G floating 
74FD EMODH Extended Multiply and Integerize H floating 


Description: 


The multiplier extension operand is concatenated with the multiplier operand to gain 8 (EMODD and EMODF), 
11 (EMODG), or 15 (EMODH) additional low order fraction bits. The low order 5 or 1 bits of the 16-bit 
multiplier extension operand are ignored by the EMODG and EMODH instructions respectively. The 
multiplicand operand is multiplied by the extended multiplier operand. The multiplication is such that the 
result is equivalent to the exact product truncated (before normalization) to a fraction field of 32 bits in 
F_floating, 64 bits in D_floating and G_floating, and 128 in H_floating. Regarding the result as the sum 
of an integer and fraction of the same sign, the integer operand is replaced by the integer part of the 


result and the fraction operand is replaced by the rounded fractional part of the result. 
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Notes: 

e On a reserved operand fault, the integer operand and the fraction operand are unaffected. 
The condition codes are UNPREDICTABLE. 

° On floating underflow, if FU is set a fault occurs. The integer and fraction parts are replaced 
by zero on the occurrence of floating underflow only if FU is clear. On a floating underflow 
fault, the integer and fraction parts are unaffected. If FU is clear, the integer and fraction 
parts are replaced by O and no exception occurs. 

e On integer overflow, the integer operand is replaced by the low order bits of the true result. 

e Floating overflow is indicated by integer overflow; however integer overflow is possible in the 
absence of floating overflow. 

e The signs of the integer and fraction are the same unless integer overflow results. 

e Because the fraction part is rounded after separation of the integer part, it is possible that the 


value of the fraction operand is 1. 
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MNEG Move Negated 
Format: 

opcode src.rx, dst.wx 
Operation: 

dst <- -src; 


Condition Codes: 


N <- dst LSS 0; 
Z <- dst EQL 0; 
V <- O; 
Cc <- 0; 
Exceptions: 
reserved operand 
Opcodes: 


52 MNEGF Move Negated F floating 
72 MNEGD Move Negated D floating 
52FD MNEGG Move Negated G floating 
72FD MNEGH Move Negated H floating 


Description: 
The destination operand is replaced by the negative of the source operand. 
Notes: 


On a reserved operand fault, the destination operand is unaffected and the condition codes are 
UNPREDICTABLE. 
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MOV Move 
Format: 

opcode src.rx, dst.wx 
Operation: 

dst <- src: 


Condition Codes: 


N <- dst LSS Q; 

Z<- dst EQL 0; 

V <- 0; 

C <= Ce 
Exceptions: 


reserved operand 
Opcodes: 
50 MOVF Move F floating 
70 MOVD Move D floating 


50FD MOVG Move G floating 
70FD MOVH Move H floating 


Description: 
The destination operand is replaced by the source operand. 
Notes: 


On a reserved operand fault, the destination operand is unaffected and the condition codes are 
UNPREDICTABLE. 
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MUL Multiply 
Format: 
opcode mulr.rx, prod.mx 2 operand 
opcode mulr.rx, muld.rx, prod.wx 3 operand 
Operation: 
prod <- prod * mulr; !2 operand 
prod <- muld * mulr; !3 operand 


Condition Codes: 


N <- prod LSS 0; 
Z <- prod EQL 0; 
V <- Q; 
Cc <- 0; 

Exceptions: 


floating overflow 
floating underflow 
reserved operand 


Opcodes: 
44 MULF2 Multiply F floating 2 Operand 
45 MULF3 Multiply F floating 3 Operand 
64 MULD2 Multiply D floating 2 Operand 
65 MULD3 Multiply D floating 3 Operand 
44FD MULG2 Multiply G floating 2 Operand 
45FD MULG3 Multiply G floating 3 Operand 
64FD MULH2 Multiply H floating 2 Operand 
65FD MULH3 Multiply H floating 3 Operand 


Description: 

In 2 operand format, the product operand is multiplied by the multiplier operand and the product operand 
is replaced by the rounded result. In 3 operand format, the multiplicand operand is multiplied by the multiplier 
operand and the product operand is replaced by the rounded result. 


Notes: 


e On a reserved operand fault, the product operand is unaffected and the condition codes are 
UNPREDICTABLE. 
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e On floating underflow, if FU is set a fault occurs. Zero is stored as the result of floating 
underflow only if FU is clear. On a floating underflow fault, the product operand is unaffected. 
If FU is clear, the product operand is replaced by O and no exception occurs. 


e On floating overflow, the instruction faults; the product operand is unaffected, and the condition 
codes are UNPREDICTABLE. 
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Format: 


Operation: 


POLY Polynomial Evaluation 


opcode arg.rx, degree.rw, tbladdr.ab 


tmpl <- degree; 

if tmpl GTRU 31 then RESERVED OPERAND FAULT; 

tmp2 <- tbladdr; 

tmp3 <- {(tmp2)+}; {tmp3 accumulates the partial result 

!tmp3 is of type x 

if POLYH then -(SP) <- arg; 

while tmpl GTRU 0 do 

begin {computation loop 

tmp4 <- {arg * tmp3}; !tmp4 accumulates new partial result. 

!tmp3 has old partial result. 

!Perform multiply, and retain the 31 (POLYF), 
163 (POLYD, POLYG), or 127 (POLYH) most significant 
!bits of the fraction by truncating the unnormalized 
!product. (The most significant bit of the 31, 63, 
for 127 bits in the product magnitude will be zero 
!if the product magnitude is LSS 1/2 and GEQ 1/4.) 
!Use the result in the following add operation. 

tmp4 <- tmp4 + (tmp2); 
!Align fractions, perform add, and retain the 
131 (POLYF), 63 (POLYD, POLYG), or 127 (POLYH) 
!most Significant bits of the fraction by truncating 
!the unnormalized result. 
!normalize, and round to type x. 
{Check for over/underflow only after the combined 
tmultiply/add/normalize/round sequence. 

if OVERFLOW then FLOATING OVERFLOW FAULT 

if UNDERFLOW then 


begin 

if FU EQL 1 then FLOATING UNDERFLOW FAULT; 
tmp4 <- 0; !force result to 0; 

end; 


tmpl <- tmpl - 1; 
tmp2 <- tmp2 + {size of data type}; 


tmp3 <- tmp4; fupdate partial result in tmp3 
end; 
if POLYF then 

begin 

RO <- tmp3; 

Rl <- QO; 

R2 <- 0; 


R3 <- tmp2; 
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end: 
if POLYD or POLYG then 
begin 
R1'RO <- tmp3; 
R2 <- 0; 
R3 <- tmp2; 
R4 <- 0; 
R5 <= 0 
end; 


if POLYH then 


Condition Codes: 


Exceptions: 


Opcodes: 


95 
79 
S5FD 
75FD 


N <- RO 
Z <- RO 
V <- 0; 
CG -<= 0; 


begin 

SP <- SP + 16; 
R3'R2'R1'RO <- tmp3; 
R4 <- 0; 

R5 <- tmp2; 

end: 


LSS 0; 
EQL 0; 


floating overflow 
floating underflow 
reserved operand 


POLYF 
POLYD 
POLYG 
POLYH 


Polynomial Evaluation 
Polynomial Evaluation 
Polynomial Evaluation 
Polynomial Evaluation 


F floating 
D floating 
G floating 
H floating 
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Description: 


The table address operand points to a table of polynomial coefficients. The coefficient of the highest order 
term of the polynomial is pointed to by the table address operand. The table is specified with lower order 
coefficients stored at increasing addresses. The data type of the coefficients is the same as the data type 
of the argument operand. The evaluation is carried out by Horner’s method and the contents of RO (R1’RO 
for POLYD and POLYG, R3’R2’R1’RO for POLYH) are replaced by the result. The result computed is: 


if d = degree 
and x = arg 
result = C[LO]*x**0 + x*(C[1] + x*(C[2] + ... x*c[d])) 


The unsigned word degree operand specifies the highest numbered coefficient to participate in the evaluation. 
POLYH requires four longwords on the stack to store arg in case the instruction is interrupted. 


Notes: 


as follows: 


After execution: 


POLYF 
RO = result 
R1 = 0 
Re = 0 


R3 = table address + degree*4 + 4 


POLYD and POLYG 
RO = high order part of result 


R1 = low order part of result 

R2 = 0 

R3 = table address + degree*8 + 8 
R4 = 0 

R5 = 0 

POLYH 


RO = highest order part of result 

R1 = second highest order part of result 
R2 = second lowest order part of result 
R3 = lowest order part of result 

R4 = 0 

R5 = table address + degree*16 + 16 


On a floating fault: 


1. If PSL<FPD> = 0, the instruction faults and all relevant side effects are restored to their 
Original state. 


2. If PSL<FPD> = 1, the instruction is suspended and state is saved in the general registers 
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POLYF 
RO = tmp3 !partial result after iteration prior to the 
fone causing the overflow/underflow 


Rl = arg 
R2<7:0> = tmpl {number of iterations remaining 
R2<31:8> = implementation specific 


R3 = tmp2 !points to table entry causing exception 


POLYD and POLYG 

R1'RO = tmp3 !partial result after iteration prior to the 
fone causing the overflow/underflow 

R2<7:0> = tmpl {number of iterations remaining 

R2<31:8> = implementation specific 

R3 = tmp2 !points to table entry causing exception 

R5'R4 = arg 


POLYH 
R3'R2'R1'RO = tmp3 !partial result after iteration prior to 
!the one causing the overflow/underflow 


R4<7:0> = tmpl {number of iterations remaining 
R4<31:8> = implementation specific 
R5 = tmp2 {points to table entry causing exception 


arg is saved on the stack in use during the faulting 
instruction. 


Implementation specific information is saved to allow the 


instruction to continue after possible scaling of the 
coefficients and partial result by a fault handler. 


p If the unsigned word degree operand is 0 and the argument is not a reserved operand, the 
result is C[O]. If the degree is 0, and either the argument or C/O] is a reserved operand, a 
reserved operand fault occurs. 

e If the unsigned word degree operand is greater than 31, a reserved operand fault occurs. 


° On a reserved operand fault: 


1. if PSL<FPD> = O, the reserved operand is either the degree operand (greater than 31), 
or the argument operand, or some coefficient. 


2. if PSL<FPD> = 1, the reserved operand is a coefficient, and R3 (except for POLYH) 
or R5 (for POLYH) is pointing at the value which caused the exception. 


3. The state of the saved condition codes and the other registers is UNPREDICTABLE. If 


the reserved operand is changed and the contents of the condition codes and all registers 
are preserved, the fault is continuable. 


e On floating underflow after the rounding operation at any iteration of the computation loop, a 
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Example: 


fault occurs if FU is set. If FU is clear, the temporary result (tmp3) is replaced by zero and 
the operation continues. In this case the final result may be non zero if underflow occurred 
before the last iteration. 


On floating overflow after the rounding operation at any iteration of the computation loop, the 
instruction terminates with a fault. 


If the argument is zero, the result is C[O]. Additionally, if one of the coefficients in the table 
(other than C[O]) is a reserved operand, whether a reserved operand fault occurs is 
UNPREDICTABLE. 


For POLYH, some implementations may not save arg on the stack until after an interrupt or 
fault occurs. However, arg will always be on the stack if an interrupt or floating fault occurs 
after FPD is set. If the four longwords on the stack overlap any of the source operands, the 
results are UNPREDICTABLE. 


To compute P(x) = CO + Cl*x + C2*x**2 


where C0 


PTABLE: 


= 1.0, Cl = .5, and C2 = .25 


POLYF X,#2,PTABLE 


FLOAT 0.25 °C2 
FLOAT 0.5 -Cl 
FLOAT 1.0 >CO0 
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Format: 


Operation: 


SUB 


opcode 


opcode 


dif <- 
dif <- 


Condition Codes: 


Exceptions: 


Opcodes: 


42 
43 
62 
63 
42FD 
43FD 
62FD 
63FD 


<- 0; 
<- 0: 


a 


ASN 


floating 
floating 
reserved 


SUBF2 
SUBF3 
SUBD2 
SUBD3 
SUBG2 
SUBG3 
SUBH2 
SUBH3 


Description: 


Subtract 


sub.rx, 


sub.rx, min.rx, 


dif - sub; 


min —- sub; 


<- dif LSS 0; 
<- dif EQL 0; 


Subtract 
Subtract 
Subtract 
Subtract 
Subtract 
Subtract 
Subtract 
Subtract 


dif .mx 


overflow 
underflow 
operand 


F floating 
F floating 
D floating 
D floating 
G floating 
G floating 
H floating 
H floating 


dif.wx 


WN WD W DN W DN 
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2 operand 


3 operand 


!2 operand 


{3 operand 


Operand 
Operand 
Operand 
Operand 
Operand 
Operand 
Operand 
Operand 


In 2 operand format, the subtrahend operand is subtracted from the difference operand and the difference 
is replaced by the rounded result. In 3 operand format, the subtrahend operand is subtracted from the 
minuend operand and the difference operand is replaced by the rounded result. 


Notes: 


On a reserved operand fault, the difference operand is unaffected and the condition codes 
are UNPREDICTABLE. 
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e On floating underflow, if FU is set a fault occurs. Zero is stored as the result of floating 
underflow only if FU is clear. On a floating underflow fault, the difference operand is unaffected. 
If FU is clear, the difference operand is replaced by 0 and no exception occurs. 


e On floating overflow, the instruction faults; the difference operand is unaffected, and the 
condition codes are UNPREDICTABLE. 
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TST Test 
Format: 
opcode src.rx 
Operation: 
src - O; 


Condition Codes: 


N <- src LSS 0; 
Z<- src EQL 0; 
V <- 0; 
Cc <- 0: 


Exceptions: 


reserved operand 


Opcodes: 
53 TSTF Test F floating 
73 TSTD Test D floating 


53FD TSTG Test G floating 
73FD TSTH Test H floating 


Description: 
The condition codes are affected according to the value of the source operand. 
Notes: 


° TSTx src is equivalent to CMPx src, #0, but is 5 (F_floating) or 9 (D_floating or G_floating) 
or 17 (H_floating) bytes shorter. 


e On a reserved operand fault, the condition codes are UNPREDICTABLE. 
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4.10 CHARACTER STRING INSTRUCTIONS 
NOTE 


Character string instructions, except for MOVC3 and MOVC5, may not be 
implemented by some microVAX processors. Unimplemented character string 
instructions result in an emulated instruction exception on microVAX processors. For 
more details, refer to Appendix B. 


A character string is specified by 2 operands: 
e An unsigned word operand which specifies the length of the character string in bytes. 


e The address of the lowest addressed byte of the character string. This is specified by a byte 
operand of address access type. 


Each of the character string instructions uses general registers RO through R1, RO through R83, or RO 
through R5 to contain a control block which maintains updated addresses and state during the execution 
of the instruction. At completion, these registers are available to software to use as string specification 
operands for a subsequent instruction on a contiguous character string. During the execution of the instructions, 
pending interrupt conditions are tested and if any is found, the control block is updated, a first part done 
bit is set in the PSL, and the instruction interrupted (See Chapter 6). After the interruption, the instruction 
resumes transparently. The format of the control block is: 


The fields LENGTH 1, LENGTH 2 (if required) and LENGTH 3 (if required) contain the number of bytes 
remaining to be processed in the first, second and third string operands respectively. The fields ADDRESS 
1, ADDRESS 2 (if required) and ADDRESS 3 (if required) contain the address of the next byte to be 
processed in the first, second, and third string operands respectively. 


Memory access faults will not occur when a zero length string is specified because no memory reference 
occurs. 
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e Compare Characters 3 Operand 
CMPC3 len.rw, srciaddr.ab, src2addr.ab, {RO-3.wl} 


e Compare Characters 5 Operand 
CMPC5 srcilen.rw, srctaddr.ab, fill.rb, src2len.rw, src2addr.ab, {RO-3.wl} 


e Locate Character 
LOCC char.rb, len.rw, addr.ab, {RO-1.wl} 


° Match Characters 
MATCHC lent.rw, addri.ab, len2.rw, addr2.ab, {RO-3.wl} 


° Move Character 3 Operand 
MOVCS len.rw, srcaddr.ab, dstaddr.ab, {RO-5.wl} 


° Move Character 5 operand 
MOVC5 srclen.rw, srcaddr.ab, fill.rb, dstlen.rw, dstaddr.ab, {RO-5.wl} 


e Move Translated Characters 
MOVTC srclen.rw, srcaddr.ab, fill.rb, tbladdr.ab, dstlen.rw, dstaddr.ab, {RO-5.wi} 


° Move Translated Until Character 
MOVTUC srclen.rw, srcaddr.ab, esc.rb, tbladdr.ab, dstlen,rw, dstaddr.ab, {R0-5.wl} 


e Scan Characters 
SCANC len.rw, addr.ab, tbladdr.ab, mask.rb, {RO-3.wl} 


° Skip Character 
SKPC char.rb, len.rw, addr.ab, {RO-1.wl} 


e Span Characters 
SPANC len.rw, addr.ab, tbladdr.ab, mask.rb, {R0O-3.wl} 
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Format: 


Operation: 


CMPC Compare Characters 


opcode len.rw, srcladdr.ab, src2addr.ab 3 operand 


opcode srcllen.rw, srcladdr.ab, fill.rb, 
src2len.rw, src2addr.ab 5 operand 


tmpl <- len; !3 operand 
tmp2 <- srcladdr; 


tmp3 <- src2addr; 
if tmpl EQL O then; !Condition Codes affected on tmpl EQL 0 
1f tmpl GTRU O then 

begin 


while {tmpl NEQU 0} do 
if (tmp2) EQL (tmp3) then 
!Condition Codes affected on ((tmp2) EQL (tmp3)) 


begin 

tmpl <- tmpl - 1; 
tmp2 <- tmp2 + 1; 
tmp3 <- tmp3 + 1; 
end; 


else exit while loop; 


end; 
RO <- tmpl; 
Rl <- tmp2; 
R2 <- RO; 
R3 <- tmp3; 


tmpl <- srcllen; {5 operand 
tmp2 <- srcladdr; 
tmp3 <- src2len; 
tmp4 <- src2addr; 


if {tmpl EQL 0} AND {tmp3 EQL 0} then; 

!Condition codes affected on {tmpl EQL 0} AND {tmp3 EQL 0} 
while {tmpl NEQU 0} AND {tmp3 NEQU 0} do 
if (tmp2) EQL (tmp4) then 


!Condition Codes affected on ((tmp2) EQL (tmp4)) 
begin 
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tmpl <- tmpl 
tmp2 <- tmp2 
tmp3 <- tmp3 
tmp4 <- tmp4 
end; 


+ 1+ 
bb bt 
=e Se We WO 


else exit while loop; 
if NOT{tmpl NEQU 0} AND {tmp3 NEQU 0} then 


while 


while 


RO <- 
Rl <- 
R2 <- 
R3 <- 


Condition Codes: 


begin 


{tmpl NEQU 0} AND {(tmp2) EQL fill} do 
{Condition Codes affected on 
begin 
tmpl <- tmpl - 1; 
tmp2 <- tmp2 + 1; 
end; 


{tmp3 NEQU 0} AND {fill EQL (tmp4)} do 


{Condition Codes affected on 
begin 
tmp3 <- tmp3 - 1; 
tmp4 <- tmp4 + 1; 
end; 


end; 


tmpl; 
tmp2; 
tmp3; 
tmp4 ; 


[Final Condition Codes reflect last affecting 
lof Condition Codes in Operation above. 


N <<; 
Z<; 
V < 0; 
Ct; 
Exceptions: 
none 
Opcodes: 
29 CMPC3 


2D CMPC5 


Compare Characters 3 Operand 
Compare Characters 5 Operand 
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((tmp2) EQL fill) 


(fill EQL (tmp4)) 
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Description: 


In 3 operand format, the bytes of string 1 specified by the length and address 1 operands are compared 
with the bytes of string 2 specified by the length and address 2 operands. Comparison proceeds until 
inequality is detected or all the bytes of the strings have been examined. Condition codes are affected by 
the result of the last byte comparison. In 5 operand format, the bytes of the string 1 specified by the length 
1 and address 1 operands are compared with the bytes of the string 2 specified by the length 2 and 
address 2 operands. If one string is longer than the other, the shorter string is conceptually extended to 
the length of the longer by appending (at higher addresses) bytes equal to the fill operand. Comparison 
proceeds until inequality is detected or all the bytes of the strings have been examined. Condition codes 
are affected by the result of the last byte comparison. For either CMPC3 or CMPC5 two zero length strings 
compare equal (i.e. Z is set and N, V, and C are cleared). 


Notes: 
° After execution of CMPC3: 

RO = number of bytes remaining in string 1 (including 
byte which terminated comparison); 
RO is zero only if strings are equal 

Rl = address of the byte in string 1 which terminated 
comparison; if strings are equal, address of one 
byte beyond string l 

R2 = RO 


R3 


address of the byte in string 2 which terminated 
comparison; if strings are equal, address of 
one byte beyond string 2. 


® After execution of CMPC5: 


RO = number of bytes remaining in string 1 (including 
byte which terminated comparison); RO is zero only 
if string 1 and string 2 are of equal length and 
equal or string 1 was exhausted before comparison 
terminated 


Rl = address of the byte in string 1 which terminated 
comparison; if comparison did not terminate 
before string 1 exhausted, address of one byte 
beyond string l 


R2 = number of bytes remaining in string 2 (including 
byte which terminated comparison); R2 is zero 
only if string 2 and string 1 are of equal length 
or string 2 was exhausted before comparison terminated 
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R3 = address of the byte in string 2 which terminated 
comparison; if comparison did not terminate before 
String 2 was exhausted, address of one byte beyond 
String 2. 


e If both strings have zero length, condition code Z is set and N, V, and C are cleared just as 
in the case of two equal strings. 
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LOCC Locate Character 
Format: 

opcode char.rb, len.rw, addr.ab 
Operation: 


tmpl <- len; 

tmp2 <- addr; 

if tmpl GTRU O then 
begin 

while {tmpl NEQ 0} AND {(tmp2) NEQ char} do 
begin 
tmpl <- tmpl - 1; 
tmp2 <- tmp2 + 1; 
end; 
end: 

RO <- tmpl; 

Rl <- tmp2; 


Condition Codes: 


N <- Q; 
Z <- RO EQL 0; 
V <- 0; 
C <- OQ; 
Exceptions: 
none 
Opcodes: 


3A LOCC Locate Character 


Description: 

The character operand is compared with the bytes of the string specified by the length and address operands. 
Comparison continues until equality is detected or all bytes of the string have been compared. If equality 
is detected; the condition code Z-bit is cleared; otherwise the Z-bit is set. 

Notes: 


® After execution: 


RO = number of bytes remaining in the string (including 
located one) if byte located; otherwise 0 


INSTRUCTIONS Page 4-148 
Character String Instructions 


Rl = address of the byte located if byte located; otherwise 
address of one byte beyond the string. 


e If the string has zero length, condition code Z is set just as though each byte of the entire 
string were unequal to character. 
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MATCHC Match Characters 


Format: 


opcode objlen.rw, objaddr.ab, srclen.rw, srcaddr.ab 


Operation: 


tmpl <- objlen; 
tmp2 <- objaddr; 
tmp3 <- srclen; 
tmp4 <- srcaddr; 
tmp5 <- tmpl; 


while {tmpl NEQU 0} AND {tmp3 GEQU tmpl} do 


begin 


if (tmp2) EQL (tmp4) 


else 


end; 


begin 
tmpl <- tmpl 


tmp2 <- tmp2 
tmp3 <- tmp3 
tmp4 <- tmp4 
end 

begin 


tmp3 <- {tmp3 


if {tmp3 LSSU tmpl} then 


begin 

tmp4 <- tmp4 + tmp3; 
tmp3 <- 0; 

end; 


RO <- tmpl; 
Rl <- tmp2; 
R2 <- tmp3; 
R3 <- tmp4; 


Condition Codes: 


<- 0; 
<- RO EQL 0; 
<- 0; 


<- 0; 


? 


ASIN]! 


!match found 


tmp5; 


then 


+ 1+ 
ae 
~e oe SCO WO 


tmp2 <- tmp2 - ZEXT (tmp5-tmpl); 

- 13} + {tmp5-tmp1}; 

tmp4 <- {tmp4 + 1} - ZEXT (tmp5-tmpl); 
tmpl <- 
end; 
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Chara 


Exceptions: 


Opcodes: 


cter String Instructions 


none 


39 MATCHC Match Characters 


Description: 


The source 


string specified by the source length and source address operands is searched for a substring 


which matches the object string specified by the object length and object address operands. If the substring 
is found, the condition code Z-bit is set; otherwise, it is cleared. 


Notes: 


After execution: 


RO = if a match occurred 0: otherwise the number of 
bytes in the object string. 


Rl = if a match occurred, the address of one byte beyond 
the object string i.e. objaddr + objlen; otherwise 
the address of the object string. 


R2 = if a match occurred, the number of bytes remaining in 
the source string; otherwise 0. 


R3 = 1f a match occurred, the address of 1 byte beyond 
the last byte matched; otherwise the address of l 
byte beyond the source string 1.e. srcaddr + srclen. 


For zero length source and object strings, R3 and R1 contain 
the source and object addresses respectively. 


If both strings have zero length or if the object string has zero length, condition code Z is 
set and registers RO-R3 are left just as though the substring were found. 


If the source string has zero length and the object string has non-zero length, condition code 
Z is cleared and registers RO-R3 are left just as though the substring were not found. 
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Format: 


Operation: 


MOVC 


opcode l 


Move Character 


en.rw, sSrcaddr.ab, dstaddr.ab 3 operand 


opcode srclen.rw, srcaddr.ab, fill.rb, 
dstlen.rw, dstaddr.ab 


tmpl <- 
tmp2 <- 
tmp3 <- 
if tmp2 


else 


len; 

srcaddr; 

dstaddr; 

GTRU tmp3 then 

begin 

while tmpl NEQU 0 do 
begin 
(tmp3) <- (tmp2); 
tmpl <- tmpl - 1; 
tmp2 <- tmp2 + 1; 
tmp3 <- tmp3 + 1; 
end; 

Rl <- tmp2; 

R3 <- tmp3; 

end 

begin 


tmp4 <- tmpl; 

tmp2 <- tmp2 + ZEXT(tmp1) 

tmp3 <- tmp3 + ZEXT(tmpl) 

while tmpl NEQU 0 do 
begin 
tmpl <- tmpl - 1; 
tmp2 <- tmp2 - 1; 
tmp3 <- tmp3 - 1; 
(tmp3) <- (tmp2); 
end; 

Rl <- tmp2 + ZEXT(tmp4); 

R3 <- tmp3 + ZEXT(tmp4); 

end; 


5 operand 


!3 operand 


=e 


~e 
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tmpl <- srclen; !5 operand 
tmp2 <- srcaddr; 

tmp3 <- dstlen; 

tmp4 <- dstaddr; 

if tmp2 GTRU tmp4 then 


begin 
while {tmpl NEQU 0} AND {tmp3 NEQU 0} do 
begin 
(tmp4) <- (tmp2); 
tmpl <- tmpl - 1; 
tmp2 <- tmp2 + 1; 
tmp3 <- tmp3 - 1; 
tmp4 <- tmp4 + 1; 
end: 
while tmp3 NEQU 0 do 
begin 
(tmp4) <- fill; 
tmp3 <- tmp3 - 1; 
tmp4 <- tmp4 + 1; 
end; 
Rl <- tmp2; 
R3 <- tmp4; 
end 
else 
begin 
tmp5 <- MINU(tmpl, tmp3); 
tmp6 <- tmp3; 
tmp2 <- tmp2 + ZEXT(tmp5); 
tmp4 <- tmp4 + ZEXT(tmp6); 
while tmp3 GTRU tmpl do 
begin 
tmp3 <- tmp3 - 1; 
tmp4 <- tmp4 - 1; 
(tmp4) <- fill; 
end; 
while tmp3 NEQU 0 do 
begin 
tmpl <- tmpl - 1; 
tmp2 <- tmp2 - 1; 
tmp3 <- tmp3 - 1; 
tmp4 <- tmp4 - 1; 
(tmp4) <- (tmp2); 
end: 
Rl <- tmp2 + ZEXT (tmp5); 
R3 <- tmp4 + ZEXT (tmp6); 
end; 
RO <- tmpl; 
R2 <- 0; 
R4 <- 0; 


R5 <- 0; 
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Condition Codes: 


N <- 0; !MOVC3 
Z. <= 1s 
V <- Q; 
C <- Q; 
N <- srclen LSS dstlen; !MOVC5 
Z<- srclen EQL dstlen; 
V <- 0; 
C <- srclen LSSU dstlen; 
Exceptions: 
none 
Opcodes: 


28 MOVC3 Move Character 3 Operand 
2C MOVC5 Move Character 5 Operand 


Description: 


In 3 operand format, the destination string specified by the length and destination address operands is 
replaced by the source string specified by the length and source address operands. In 5 operand format, 
the destination string specified by the destination length and destination address operands is replaced by 
the source string specified by the source length and source address operands. If the destination string is 
longer than the source string, the highest addressed bytes of the destination are replaced by the fill operand. 
If the destination string is shorter than the source string, the highest addressed bytes of the source string 
are not moved. The operation of the instruction is such that overlap of the source and destination strings 
does not affect the result. 
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Notes: 


@ After execution of MOVCS3: 


RO = 0 

Rl = address of one byte beyond the source string 

R2 = 0 

R3 = address of one byte beyond the destination string. 
R4 = 0 

R5 = 0 


e After execution of MOVC5: 


RO = number of unmoved bytes remaining in source string. 
RO is non-zero only if source string is longer 
than destination string 


Rl = address of one byte beyond the last byte 
in source string that was moved 


2) 
NO 
li 
© 


R3 = address of one byte beyond the destination string. 


R4 = Q 
R5 = 0 
° MOVC3 is the preferred way to copy one block of memory to another. 


e MOVC5 with a 0 source length operand is the preferred way to fill 


a block of memory with the fill character. 
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Format: 


Operation: 


MOVTC Move Translated Characters 


opcode srclen.rw, srcaddr.ab, fill.rb, tbladdr.ab, 
dstlen.rw, dstaddr.ab 


tmpl <- srclen; 

tmp2 <- srcaddr; 

tmp3 <- dstlen; 

tmp4 <- dstaddr; 

if tmp2 GTRU tmp4 then 


begin 
while {tmpl NEQU 0} AND {tmp3 NEQU 0} 
begin 
(tmp4) <- (tbladdr + ZEXT((tmp2))); 
tmpl <- tmpl - 1; 
tmp2 <- tmp2 + 1; 
tmp3 <- tmp3 - Il; 
tmp4 <- tmp4 + 1; 
end; 
while {tmp3 NEQU 0} do 
begin 


(tmp4) <- fill; 
tmp3 <- tmp3 - 1; 
tmp4 <- tmp4 + 1; 
end; 

Rl <- tmp2; 

RS <- tmp4; 

end; 

else 

begin 

tmp5 <- MINU(tmpl,tmp3); 

tmp6 <- tmp3; 

tmp2 <- tmp2 + ZEXT(tmp5) 

tmp4 <- tmp4 + ZEXT(tmp6) 

while tmp3 GTRU tmpl do 
begin 
tmp3 <- tmp3 - 1; 
tmp4 <- tmp4 - 1; 
(tmp4) <- fill; 
end; 

while tmp3 NEQU 0 do 
begin 
tmpl <- tmpl - 
tmp2 <- tmp2 
tmp3 <- tmp3 
tmp4 <- tmp4 - 


=e tO 


bb 
~e =e OE WO 
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(tmp4) <- (tbladdr + ZEXT((tmp2))); 
end; 

Rl <- tmp2 + ZEXT(tmp5); 

R5 <- tmp4 + ZEXT(tmp6); 


end; 
RO <- tmpl; 
R2 <- 0; 
R3 <- tbladdr; 
R4 <- 0; 


Condition Codes: 


N <- srclen LSS dstlen; 
Z<- srclen EQL dstlen; 
V <- 0; 
 <- srclen LSSU dstlen; 
Exceptions: 
none 
Opcodes: 


2E MOVTC Move Translated Characters 
Description: 


The source string specified by the source length and source address operands is translated and replaces 
the destination string specified by the destination length and destination address operands. Translation is 
accomplished by using each byte of the source string as an index into a 256 byte table whose zeroth entry 
address is specified by the table address operand. The byte selected replaces the byte of the destination 
String. If the destination string is longer than the source string, the highest addressed bytes of the destination 
string are replaced by the fill operand. If the destination string is shorter than the source string, the highest 
addressed bytes of the source string are not translated and moved. The operation of the instruction is such 
that overlap of the source and destination strings does not affect the result. If the destination string overlaps 
the translation table, the destination string is UNPREDICTABLE. 


Notes: 
After execution: 
RO = number of untranslated bytes remaining in source string; 
RO iS non-zero only if source string is longer than 


destination string 


Rl = address of one byte beyond the last byte in 
source string that was translated 


R2 = 0 
R3 = address of the translation table. 


R4 = 0 
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R5 = address of one byte beyond the destination 
string. 


INSTRUCTIONS Page 4-158 
Character String Instructions 


MOVTUC Move Translated Until Character 
Format: 


opcode srclen.rw, srcaddr.ab, esc.rb, tbladdr.ab, dstlen.rw, 
dstaddr.ab 


Operation: 


tmpl <- srclen; 
tmp2 <- srcaddr; 
tmp3 <- dstlen; 
tmp4 <- dstaddr; 


if tmpl GTRU O and tmp3 GTRU O then 
begin 


while {tmpl NEQU 0} AND {tmp3 NEQU 0} do 
if{(tbladdr + ZEXT(tmp2)) NEQU esc} then 


begin 

(tmp4) <- (tbladdr + ZEXT(tmp2)); 
tmpl <- tmpl - 1; 

tmp2 <- tmp2 + 1; 

tmp3 <- tmp3 - 1; 

tmp4 <- tmp4 + 1; 

end; 


else exit while loop; 
end; 


RQ <- tmpl; 

Rl <- tmp2; 

R2 <- 0; 

R3 <- tbladdr; 
R4 <- tmp3; 

RS <- tmp4; 


Condition Codes: 


<- srclen LSS dstlen; 

<- srclen EQL dstlen; 

<- {terminated by escape}; 
<- srclen LSSU dstlen; 


ASIN 


Exceptions: 


none 
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Opcodes: 


2F 


MOVTUC Move Translated Until Character 


Description: 


The source string specified by the source length and source address operands is translated and replaces 
the destination string specified by the destination length and destination address operands. Translation is 
accomplished by using each byte of the source string as index into a 256 byte table whose -zeroth entry 
address is specified by the table address operand. The byte selected replaces the byte of the destination 
string. Translation continues until a translated byte is equal to the escape byte or until the source string or 
destination string is exhausted. If translation is terminated because of escape the condition code V-bit is 
set; otherwise it is cleared. If the destination string overlaps the table, the destination string and registers 
RO through R5 are UNPREDICTABLE. If the source and destination strings overlap and their addresses are 
not identical, the destination string and registers RO through R5 are UNPREDICTABLE. If the source and 
destination string addresses are identical, the translation is performed correctly. 


Notes: 
After 


RO 


Rl 


R2 
R3 
R4 


R5 


execution: 


= number of bytes remaining in source string (including 
the byte which caused the escape). RO is zero only 
if the entire source string was translated and 
moved without escape 


= address of the byte which resulted in destination 
string exhaustion or escape; or if no exhaustion or 
escape, address of one byte beyond the source string 


= 0 
= address of the table 
= number of bytes remaining in the destination string 


= address of the byte in the destination string 
which would have received the translated byte 
which caused the escape or would have received a 
translated byte if the source string were not exhausted; 
or if no exhaustion or escape, the address of one byte 
beyond the destination string. 
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SCANC Scan Characters 
Format: 

opcode len.rw, addr.ab, tbladdr.ab, mask.rb 
Operation: 


tmpl <- len; 

tmp2 <- addr; 

if tmpl GTRU 0 then 
begin 

while {tmpl NEQU 0} AND 
{{(tbladdr + ZEXT((tmp2))) AND mask} EQL 0} do 
begin 
tmpl <- tmpl - 1; 
tmp2 <- tmp2 + 1; 
end; 
end; 

RO <- tmpl; 

Rl <- tmp2; 

R2 <- 0; 

R3 <- tbladdr; 


Condition Codes: 


N <- 0; 
Z <- RO EQL OQ; 
V <- QO; 
C <- 0; 
Exceptions: 
none 
Opcodes: 


2A SCANC Scan Characters 


Description: 


The bytes of the string specified by the length and address operands are successively used to index into 
a 256 byte table whose zeroth entry address is specified by the table address operand. The byte selected 
from the table is ANDed with the mask operand. The operation continues until the result of the AND is 
non-zero or all the bytes of the string have been exhausted. If a non-zero AND result is detected, the 
condition code Z-bit is cleared; otherwise, the Z-bit is set. 
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Notes: 
° After execution: 
RO = number of bytes remaining in the string (including 


the byte which produced the non-zero AND result) 
RO is zero only if there was no non-zero AND result. 


Rl = address of the byte which produced non-zero 
AND result; or, if no non-zero result, address 
of one byte beyond the string 


R2 = 0 


R3 address of the table 


° lf the string has zero length, condition code Z is set just as though the entire string were 
scanned. 
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SKPC Skip Character 
Format: 

opcode char.rb, len.rw, addr.ab 
Operation: 


tmpl <- len; 

tmp2 <- addr; 

if tmpl GTRU 0 then 
begin 

while {tmpl NEQ 0} AND {(tmp2) EQL char} do 
begin 
tmpl <- tmpl - 1; 
tmp2 <- tmp2 + 1; 
end; 
end; 

RO <- tmpl; 

Rl <- tmp2; 


Condition Codes: 


<— 
<— 
<— 
<— 


EQL 0 


COOWo 
=e ~e CG) we 
~e 


ASNS 


Exceptions: 
none 
Opcodes: 


3B SKPC Skip Character 


Description: 

The character operand is compared with the bytes of the string specified by the length and address operands. 
Comparison continues until inequality is detected or all bytes of the string have been compared. If inequality 
is detected; the condition code Z-bit is cleared; otherwise the Z-bit is set. 

Notes: 


e After execution: 


RO = number of bytes remaining in the string (including the unequal 
one) if unequal byte located; otherwise 0 
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address of the byte located if byte located; otherwise add 


Rl = 
of one byte beyond the string. 


If the string has zero length, condition code Z is set just as though each byte of the entire 


string were equal to character. 
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SPANC Span Characters 


Format: 


opcode len.rw, addr.ab, tbladdr.ab, mask.rb 
Operation: 


tmpl <- len; 
tmp2 <- addr; 
if tmpl GTRU O then 
begin 
while {tmpl NEQU 0} AND 
{{(tbladdr + ZEXT((tmp2))) AND mask} NEQ 0} do 
begin 
tmpl <- tmpl - 1; 
tmp2 <- tmp2 + 1; 


end; 
end; 
RO <- tmpl; 
Rl <- tmp2; 


R2 <- 0: 
R3 <- tbladdr; 


Condition Codes: 


N <- 0; 
Z <- RO EQL 0; 
V <- 0; 
Cc <- 0; 
Exceptions: 
none 
Opcodes: 
2B SPANC Span Characters 
Description: 


The bytes of the string specified by the length and address operands are successively used to index into 
a 256 byte table whose zeroth entry address is specified by the table address operand. The byte selected 
from the table is ANDed with the mask operand. The operation continues until the result of the AND is 
zero or all the bytes of the string have been exhausted. If a zero AND result is detected, the condition 
code Z-bit is cleared; otherwise, the Z-bit is set. 


Notes: 


INSTRUCTIONS Page 4-165 
Character String Instructions 


e After execution: 

RO = number of bytes remaining in the string (including 
the byte which produced the zero AND result) 
RO is zero only if there was no zero AND result. 

Rl = address of the byte which produced a zero AND 
result; or, 1f no non-zero result, address of 
one byte beyond the string 

R2 = 0 


R3 = address of the table. 


e If the string has zero length, the condition code Z is set just as though the entire string were 
spanned. 
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4.11 CYCLIC REDUNDANCY CHECK INSTRUCTION 


NOTE 


The CRC instruction is not implemented by microVAX processors. The CRC instruction 
results in an emulated instruction exception on microVAX processors. For more 
details, refer to Appendix B. 


This instruction is designed to implement the calculation and checking of a cyclic redundancy check for 
any CRC polynomial up to 32 bits. Cyclic Redundancy Checking is an error detection method involving a 
division of the data stream by a CRC polynomial. The data stream is represented as a standard VAX string 
in memory. Error detection is accomplished by computing the CRC at the source and again at the destination, 
comparing the CRC computed at each end. The choice of the polynomial is such as to minimize the number 
of undetected block errors of specific lengths. The choice of a CRC polynomial is not given here; see, for 
example, the article "Cyclic Codes for Error Detection" by W. Peterson and D. Brown in the Proceedings 
of the IRE (January, 1961). 


The operands to the CRC instruction are a string descriptor, a 16-longword table, and an initial CRC. The 
string descriptor is a standard VAX operand pair of the length of the string in bytes (up to 65,535) and the 
starting address of the string. The contents of the table are a function of the CRC polynomial to be used. 
It can be calculated from the polynomial by the algorithm in the notes. Several common CRC polynomials 
are also included in the notes. The initial CRC is used to start the polynomial correctly. Typically, it has 
the value O or -1, but would be different if the data stream is represented by a sequence of non-contiguous 
strings. 


The CRC instruction operates by scanning the string, and for each byte of the data stream, including it in 
the CRC being calculated. The byte is included by XORing it to the right 8 bits of the CRC. Then the 
CRC is shifted right 1 bit, inserting zero on the left. The right most bit of the CRC (lost by the shift) is 
used to control the XORing of the CRC polynomial with the resultant CRC. If the bit is set, the polynomial 
is XORed with the CRC. Then the CRC is again shifted right and the polynomial is conditionally XORed 
with the result a total of eight times. The actual algorithm used can shift by one, two, or four bits at a 
time using the appropriate entries in a specially constructed table. The instruction produces a 32-bit CRC. 
For shorter polynomials, the result must be extracted from the 32-bit field. The data stream must be a 
multiple of eight bits in length. If it is not, the stream must be right adjusted in the string with leading 0 
bits. 
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Format: 


Operation: 


CRC Calculate Cyclic Redundancy Check 


opcode tbl.ab, inicrc.rl, strlen.rw, stream.ab 


tmpl <- strlen; 
tmp2 <- stream; 
tmp3 <- inicrc; 
tmp4 <- tbl; 
while tmpl NEQU 0 do 
begin 
tmp3<7:0><- tmp3<7:0> XOR (tmp2)+; 
for tmp5 <- 1,limit do !see notes for limit,s,i 
tmp3 <- ZEXT(tmp3<3l:s>) XOR 
(tmp4 + {4*ZEXT(tmp3<s-1:0>*i)}; 
tmpl <- tmpl -1l; 


end; 
RO <- tmp3; 
Rl <- 0; 
R2 <- 0; 
R3 <- tmp2; faddress of end of string + l 


Condition Codes: 


Exceptions: 


Opcodes: 


OB 


N <- RO LSS 0; 

Z <- RO EQL 0; 

V <- Q; 

C <- QO; 

none 

CRC Calculate Cyclic Redundancy Check 


Description: 


The CRC of the data stream described by the string descriptor is calculated. The initial CRC is given by 
inicrc and is normally O or -1 unless the CRC is calculated in several steps. The result is left in RO. If the 
polynomial is less than order-32, the result must be extracted from the result. The CRC polynomial is 
expressed by the contents of the 16-longword table. See the notes for the calculation of the table. 


INSTRUCTIONS Page 4-168 
Cyclic Redundancy Check Instruction 


Notes: 
e If the data stream is not a multiple of 8-bits long, it must be right adjusted with leading zero 
fill. 
e If the CRC polynomial is less than order 32, the result must be extracted from the low order 
bits of RO. 
e The following algorithm can be used to calculate the CRC table given a polynomial expressed 
as follows: 


polyn<n> <- {coefficient of x**f{order -l-n}} 


This routine is available as system library routine 
LIBSCRC_ TABLE (poly.rl, table.ab). The table is the 
location of a 64-byte (16-longword) table into which 
the result will be written. 


SUBROUTINE LIB$CRC TABLE (POLY, TABLE) 
INTEGER*4 POLY, TABLE(0:15), TMP, X 
DO 190 INDEX = 0, 15 


TMP = INDEX 
DO 150 I=1, 4 
X = TMP .AND. 1 
TMP = ISHFT(TMP,-1) !logical shift right one bit 
IF (X .EQ. 1) TMP = TMP .XOR. POLY 

150 CONTINUE 
TABLE( INDEX) = TMP 


190 CONTINUE 


RETURN 
END 


e The following are descriptions of some commonly used CRC polynomials. 


CRC-16 (used in DDCMP and Bisync) 


polynomial: KO LG xr x2. 
poly: 120001 (octal) 
initialize: 0 

result: RO<15:0> 


CCITT (used in ADCCP, HDLC, SDLC) 


INSTRUCTIONS Page 4-169 
Cyclic Redundancy Check Instruction 


polynomials: x°16.. 4° x7 12 4 x75. + 1 

poly: 102010 (octal) 

initialize: -1<15:0> 

result: one's complement of RO<15:0> 


AUTODIN-II 


polynomial: x*32+ x*26 + x*23 + x*224+x°164+x"12 
+xX*114%x°104+x°84+x°74+x°54+x°44x°24+Xx4+1 

poly: EDB88320 (hex) 

initialize: -1<31:0> 

result: one’s complement of R0O<31:0> 


° This instruction produces an UNPREDICTABLE result unless the table is well formed, such as 
produced in note 3. Note that for any well formed table, entry [0] is always 0 and entry[8] is 
always the polynomial expressed as in note 3. The operation can be implemented using shifts 
of one, two, or four bits at a time as follows: 


shift steps table index table index use table 
per byte multiplier entries 
(s) (limit) (i) 
1 8 tmp3<0> 8 (0J=0,(8] 
2 4 tmp3<1:0> 4 [0]=0,[4],(8],{12] 
4 2 tmp3<3:0> i all 


e If the stream has zero length, RO receives the initial CRC. 
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4.11 DECIMAL STRING INSTRUCTIONS 


NOTE 


Decimal instructions are not implemented by microVAX processors. Decimal 
instructions result in an emulated instruction exception on microVAX processors. For 
more details, refer to Appendix B. 


Decimal string instructions operate on Packed Decimal strings. Convert instructions are provided between 
Packed Decimal and Trailing Numeric String (Overpunched and Zoned) and Leading Separate Numeric string 
formats. Where necessary a specific data type is identified. Where the phrase decimal string is used, it 
means any of the three data types. 


A decimal string is specified by 2 operands: 


e For all decimal strings the length is the number of digits in the string. The number of bytes 
in the string is a function of the length and the type of decimal string referenced (see Chapter 
2). 

e The address of the lowest addressed byte of the string. This byte contains the most significant 


digit for Trailing Numeric, and packed decimal strings. This byte contains a sign for Left 
Separate Numeric strings. The address is specified by a byte operand of address access type. 


Each of the decimal string instructions uses general registers RO through R3 or RO through R5 to contain 
a control block which maintains updated addresses and state during the execution of the instruction. At 
completion, the registers containing addresses are available to the software to use as string specification 
operands for a subsequent instruction on the same decimal strings. 


During the execution of the instructions, pending interrupt conditions are tested and if any is found, the 
control block is updated. First Part Done is set in the PSL, and the instruction interrupted (See chapter 6). 
After the interruption, the instruction resumes transparently. The format of the control block at completion 
is: 
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3 
1 0 


The fields ADDRESS 1, ADDRESS 2 and ADDRESS 3 (if required) contain the address of the byte containing 
the most significant digit of the first, second and third (if required) string operands respectively. 


The decimal string instructions treat decimal strings as integers with the decimal point assumed immediately 
beyond the least significant digit of the string. If a string in which a result is to be stored is longer than 
the result, its most significant digits are filled with zeros. 


4.12.1 Decimal Overflow 


Decimal overflow occurs if the destination string is too short to contain all the digits (excluding leading 
zeroes) of the result. On overflow, the destination string is replaced by the correctly signed least significant 
digits of the true result (even if the stored result is -0). Note that neither the high nibble of an even length 
packed decimal string, nor the sign byte of a Leading Separate Numeric string is used to store result digits. 


4.12.2 Zero Numbers 


A zero result has a positive sign for all operations which complete without decimal overflow, except for 
CVTPT which does not fixup a -0 to a +0. However, when digits are lost because of overflow, a zero 
result receives the sign (positive or negative) of the correct result. 


A decimal string with value -O is treated as identical to a decimal string with value +0. Thus for example 
+0 compares equal to -0. When condition codes are affected on a -0 result they are affected as if the 
result were +0: i.e., N is cleared and Z is set. 


4.12.3 Reserved Operand Exception 


A reserved operand abort occurs if the length of a decimal string operand is outside the range O through 
31, or if an invalid sign or digit is encountered in CVTSP, and CVTTP. The PC points to the opcode of 
the instruction causing the exception. 
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4.12.4 UNPREDICTABLE Results 

The result of any operation is UNPREDICTABLE if any source decimal string operand contains invalid data. 
Except for CVTSP and CVTTP, the decimal string instructions do not verify the validity of source operand 
data. 

If the destination operands overlap any source operands, the result of an operation will, in general, be 
UNPREDICTABLE. The destination strings, registers used by the instruction and condition codes will, in 
general, be UNPREDICTABLE when a reserved operand abort occurs. 

4.12.5 Packed Decimal Operations 

Packed decimal strings generated by the decimal string instructions always have the preferred sign 
representation: 12 for "+" and 13 for "-". An even length packed decimal string is always generated with 


a "0" digit in the high nibble of the first byte of the string. 


A packed decimal string contains an invalid nibble if: 


e A digit occurs in the sign position. 
e A sign occurs in a digit position. 
e For an even length string, a non-zero nibble occurs in the high order nibble of the lowest 


addressed byte. 


4.12.6 Zero Length Decimal Strings 


The length of a packed decimal string can be 0. In this case, the value is zero (plus or minus) and one 
byte of storage is occupied. This byte must contain a "O" digit in the high nibble and the sign in the low 
nibble. 


The length of a trailing numeric string can be QO. In this case no storage is occupied by the string. If a 
destination operand is a zero length trailing numeric string, the sign of the operation is lost. Memory access 
faults will not occur when a zero length trailing numeric operand is specified because no memory reference 
occurs. The value of a zero length trailing numeric string is identically 0. 


The length of a leading separate numeric string can be 0. In this case one byte of storage is occupied by 
the sign. Memory is accessed when a zero length operand is specified, and a reserved operand abort will 
occur if an invalid sign is detected. The value of a zero length leading separate numeric string is identically 
0. 
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4.12.7 Instruction Descriptions 
The following instructions are described in this section. 


° Add Packed 4 Operand 
ADDP4 addlen.rw, addaddr.ab, sumlen.rw, sumaddr.ab, {RO-3.wl} 


e Add Packed 6 Operand 
ADDP6 addilen.rw, addtaddr.ab, add2len.rw, add2addr.ab, sumlen.rw, sumaddr.ab, {RO-5.wl} 


° Arithmetic Shift and Round Packed 
ASHP cnt.rb, srclen.rw, srcaddr.ab, round.rb, dstlen.rw, dstaddr.ab, {RO-3.wl} 


° Compare Packed 3 Operand 
CMPP3 len.rw, srctaddr.ab, src2addr.ab, {RO-3.wl} 


e Compare Packed 4 Operand 
CMPP4 srcilen.rw, srciaddr.ab, src2len.rw, src2addr.ab, {RO-3.wl} 


e Convert Long to Packed 
CVTLP src.rl, dstlen.rw, dstaddr.ab, {R0O-3.wl} 


° Convert Packed to Long 
CVTPL srclen.rw, srcaddr.ab, {RO-3.wl}, dst.wl 


° Convert Packed to Leading Separate 
CVTPS srclen.rw, srcaddr.ab, dstlen.rw, dstaddr.ab, {RO-3.wl} 


° Convert Packed to Trailing 
CVTPT srclen.rw, srcaddr.ab, tbladdr.ab, dstlen.rw, dstaddr.ab, {RO-3.wl} 


e Convert Leading Separate to Packed 
CVTSP srclen.rw, srcaddr.ab, dstlen.rw, dstaddr.ab, {RO-3.wl} 


e Convert Trailing to Packed 
CVTTP srclen.rw, srcaddr.ab, tbladdr.ab, dstlen.rw, dstaddr.ab, {RO-3.wl} 


e Divide Packed 
DIVP divrien.rw, divraddr.ab, divdlen.rw, divdaddr.ab, quolen.rw, quoaddr.ab, {RQ-5.wl, 
-16(SP):-1(SP).wb} 


e Move Packed 
MOVP len.rw, srcaddr.ab, dstaddr.ab, {RO-3.wl} 


° Multiply Packed 
MULP mulrlen.rw, mulraddr.ab, muldlen.rw, muldaddr.ab, prodlen.rw, prodaddr.ab, {RO-5.wl} 


° Subtract Packed 4 Operand 
SUBP4 sublen.rw, subaddr.ab, diflen.rw, difaddr.ab, {RO-3.wl} 


INSTRUCTIONS Page 4-174 
Decimal String Instructions 


e Subtract Packed 6 Operand 
SUBP6 sublen.rw, subaddr.ab, minlen.rw, minaddr.ab, diflen.rw, difaddr.ab, {RO-5.wl} 
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Format: 


Operation: 


ADDP Add Packed 


opcode addlen.rw, addaddr.ab, sumlen.rw, 
sumaddr.ab 


opcode addllen.rw, addladdr.ab, add2len.rw, 
add2addr.ab, sumlen.rw, sumaddr.ab 


({sumaddr + ZEXT(sumlen/2)} : sumaddr) <- 
({sumaddr + ZEXT(sumlen/2)} : sumaddr) + 
({addaddr + ZEXT(addlen/2)} : addaddr); !4 operand 


({sumaddr + ZEXT(sumlen/2)} : sumaddr) <- 
({add2addr + ZEXT(add2len/2)} : add2addr) + 
({addladdr + ZEXT(addllen/2)} : addladdr); !6 operand 


Condition Codes: 


Exceptions: 


Opcodes: 


20 
21 


N <- {sum string} LSS 0; 
Z <- {sum string} EQL 0; 
V <- {decimal overflow}; 
C <- 0; 


reserved operand 
decimal overflow 


ADDP4 Add Packed 4 Operand 
ADDP6 Add Packed 6 Operand 


Description: 


In 4 operand format, the addend string specified by the addend length and addend address operands is 
added to the sum string specified by the sum length and sum address operands and the sum string is 


replaced by 


In 6 operand format, the addend 1 string specified by the addend 1 length and addend 1 address operands 
the addend 2 string specified by the addend 2 length and addend 2 address operands. The 


is added to 


the result. 


sum string specified by the sum length and sum address operands is replaced by the result. 
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e After execution of ADDP4: 


Rl = address of the byte containing the most 
Significant digit of the addend string 


R2 = 0 


oe) 
W 
Nl 


address of the byte containing the most 
Significant digit of the sum string 
e After execution of ADDP6: 

RO = 0 


Rl 


address of the byte containing the most 
Significant digit of the addendl string 


R2 = 0 

R3 = address of the byte containing the most 
Significant digit of the addend2 string 

R4 = 0 

RS = address of the byte containing the most 


Significant digit of the sum string 


° The sum string, RO through R3 (or RO through R5 for ADDP6) and the condition codes are 
UNPREDICTABLE if the sum string overlaps the addend, addend1, or addend2 strings; the 
addend, addend1, addend2 or sum (4 operand only) strings contain an invalid nibble; or a 
reserved operand abort occurs. 
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ASHP 


Format: 


Arithmetic Shift and Round Packed 


opcode cnt.rb, srclen.rw, srcaddr.ab, round.rb 


Operation: 


dstlen.rw, dstaddr.ab 


({dstaddr + ZEXT(dstlen/2)} : dstaddr) <- 


Condition Codes: 


ASN 


<- Q; 


Exceptions: 


{({srcaddr + ZEXT(srclen/2)} : srcaddr) 
+ {round <3:0>*{10 ** {-cnt-1}}}} 
* {10 ** cnt} ; 


<- {dst string} LSS 0; 
<- {dst string} EQL 0; 
<- {decimal overflow}; 


reserved operand 
decimal overflow 


Opcodes: 


F8 ASHP 


Description: 


Arithmetic Shift and Round Packed 


The source string specified by the source length and source address operands is scaled by a power of 10 
specified by the count operand. The destination string specified by the destination length and destination 
address operands is replaced by the result. 


A positive count operand effectively multiplies; a negative count effectively divides; and a zero count just 
moves and affects condition codes. When a negative count is specified, the result is rounded using the 


Round Operand. 


Notes: 


e After execution: 


address of the byte containing the most significant 
digit of the source string 
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R3 = address of the byte containing the most significant 
digit of the destination string 


° The destination string, RO through R3, and the condition codes are UNPREDICTABLE if the 
destination string overlaps the source string, the source string contains an invalid nibble, or a 
reserved operand abort occurs. 


e When the count operand is negative, the result is rounded by decimally adding bits 3:0 of 
the round operand to the most significant low order digit discarded and propagating the carry, 
if any, to higher order digits. Both the source operand and the round operand are considered 
to be quantities of the same sign for the purpose of this addition. 


e lf bits 7:4 of the round operand are non-zero, or if bits 3:0 of the round operand contain an 
invalid packed decimal digit the result is UNPREDICTABLE. 


e When the count operand is zero or positive, the round operand has no effect on the result 
except as specified in note 4. 


° The round operand is normally five. Truncation may be accomplished by using a zero round 
operand. 
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CMPP Compare Packed 
Format: 
opcode len.rw, sSrcladdr.ab, src2addr.ab 3 operand 
opcode srcllen.rw, srcladdr.ab, src2len.rw, 
src2addr.ab 4 operand 
Operation: 


({srcladdr + ZEXT(len/2)} : srcladdr) - 
({src2addr + ZEXT(len/2)} : src2addr); !3 operand 


({srcladdr + ZEXT(srcllen/2)} : srcladdr) - 
({src2addr + ZEXT(src2len/2)} : src2addr); !4 operand 


Condition Codes: 


N <- {srcl string} LSS {src2 string}; 
Z <- {srcl string} EQL {src2 string}; 
V <- OQ: 
Cc <- 03 

Exceptions: 


reserved operand 
Opcodes: 


35 CMPP3 Compare Packed 3 Operand 
37 CMPP4 Compare Packed 4 Operand 


Description: 


In 3 operand format, the source 1 string specified by the length and source 1 address operands is compared 
to the source 2 string specified by the length and source 2 address operands. The only action is to affect 


the condition codes. 


In 4 operand format, the source 1 string specified by the source 1 length and source 1 address operands 
is compared to the source 2 string specified by the source 2 length and source 2 address operands. The 


only action is to affect the condition codes. 
Notes: 


e After execution of CMPP3 or CMPP4: 
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RO = 0 


R1 


address of the byte containing the most 
Significant digit of string l. 


R2 = 0 


R3 = address of the byte containing the most 
Significant digit of string 2. 


e RO through R3 and the condition codes are UNPREDICTABLE, if the source strings overlap, 
if either string contains an invalid nibble or if a reserved operand abort occurs. 
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CVTLP Convert Long to Packed 
Format: 
opcode src.rl, dstlen.rw, dstaddr.ab 
Operation: 
({dstaddr + ZEXT(dstlen/2)} : dstaddr) <- conversion of src; 


Condition Codes: 


N <- {dst string} LSS 0; 
Z <- {dst string} EQL 0; 
V <- {decimal overflow}; 
Cc <- 0: 


Exceptions: 


reserved operand 
decimal overflow 


Opcodes: 


F9 CVTLP Convert Long to Packed 


Description: 


The source operand is converted to a packed decimal string and the destination string operand specified 
by the destination length and destination address operands is replaced by the result. 


Notes: 
° After execution: 
RO = 0 
Rl = 0 
R2 = 0 
R3 = address of the byte containing the most significant 


digit of the destination string 
° The destination string, RO through R3, and the condition codes are UNPREDICTABLE ona 
reserved operand abort. 


° Overlapping operands produce correct results. 
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Format: 


Operation: 


CVTPL Convert Packed to Long 


opcode srclen.rw, srcaddr.ab, dst.wl 


dst <- conversion of ({srcaddr + ZEXT(srclen/2)} : srcaddr); 


Condition Codes: 


Exceptions: 


Opcodes: 
36 


Description: 


The source 


N <- dst LSS 0; 

Z <- dst EQL 0; 

Vv <- {integer overflow}; 
Cc <- 0: 


reserved operand 
integer overflow 


CVTPL Convert Packed to Long 


string specified by the source length and source address operands is converted to a longword 


and the destination operand is replaced by the result. 


Notes: 


After execution: 


RO = 0 

Rl = address of the byte containing the most Significant 
digit of the source string 

R2 = 0 

R3 = 0 


The destination operand, RO through R3, and the condition codes are UNPREDICTABLE on 
a reserved operand abort or if the string contains an invalid nibble. 
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The destination operand is stored after the registers are updated as specified in 1 above. Thus 
RO through R3 may be used as the destination operand. 


If the source string has a value outside the range -2,147,483,648 through 2,147,483,647 integer 
overflow occurs and the destination operand is replaced by the low order 32 bits of the 
correctly signed infinite precision conversion. Thus, on overflow the sign of the destination 
may be different from the sign of the source. 


Overlapping operands produce correct results. 
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CVTPS Convert Packed to Leading Separate Numeric 
Format: 

opcode srclen.rw, srcaddr.ab, dstlen.rw, dstaddr.ab 
Operation: 

{dst string} <- conversion of {src string}; 
Condition Codes: 
<- {src string} LSS 0; 
<- {src string} EQL 0; 


<- {decimal overflow}; 
<- 0; 


ASN 


Exceptions: 


reserved operand 
decimal overflow 


Opcodes: 


08 CVTPS Convert Packed to Leading Separate Numeric 


Description: 


The source packed decimal string specified by the source length and source address operands is converted 
to a leading separate numeric string. The destination string specified by the destination length and destination 


address operands is replaced by the result. 


Conversion is effected by replacing the lowest addressed byte of the destination string with the ASCII 
character ’+’ or ’-’, determined by the sign of the source string. The remaining bytes of the destination 
string are replaced by the ASCII representations of the values of the corresponding packed decimal digits 


of the source string. 


Notes: 
e After execution: 
RO = 0 
Rl = 


digit of the source string 
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address of the byte containing the most significant 
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R3 = address of the sign byte of the destination string 
° The destination string, RO through R38, and the condition codes are UNPREDICTABLE if the 
destination string overlaps the source string, the source string contains an invalid nibble, or a 
reserved operand abort occurs. 


e This instruction produces an ASCIl "+" or "-" in the sign byte of the destination string. 


e If decimal overflow occurs, the value stored in the destination may be different from the value 
indicated by the condition codes (Z and N bits). 


e lf the conversion produces a -0 without overflow, the destination leading separate numeric 
string is changed to a +0 representation. 
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CVTPT Convert Packed to Trailing Numeric 
Format: 

opcode srclen.rw, srcaddr.ab, tbladdr.ab, dstlen.rw, dstaddr.ab 
Operation: 

{dst string} <- conversion of {src string}; 


Condition Codes: 


N <- {src string} LSS 0; 
Z <- {src string} EQL 0; 
V <- {decimal overflow}; 
C <- 0; 


Exceptions: 


reserved operand 
decimal overflow 


Opcodes: 


24 CVTPT Convert Packed to Trailing Numeric 


Description: 


The source packed decimal string specified by the source length and source address operands is converted 
to a trailing numeric string. The destination string specified by the destination length and destination address 
operands is replaced by the result. The condition code N and Z bits are affected by the value of the source 
packed decimal string. 


Conversion is effected by using the highest addressed byte (even if the source string value is -0) of the 
source String (i.e., the byte containing the sign and the least significant digit) as an unsigned index into a 
256 byte table whose zeroth entry address is specified by the table address operand. The byte read out 
of the table replaces the least significant byte of the destination string. The remaining bytes of the destination 
string are replaced by the ASCII representations of the values of the corresponding packed decimal digits 
of the source string. 


Notes: 
° After execution: 
RO = 0 
Rl = address of the byte containing the most significant 


digit of the source string 
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R2 = 0 


R3 = address of the most Significant digit of the 
destination string 


e The destination string, RO through R3, and the condition codes are UNPREDICTABLE if the 
destination string overlaps the source string or the table, the source string or the table contains 
an invalid nibble, or a reserved operand abort occurs. 


e The condition codes are computed on the value of the source string even if overflow results. 
In particular, condition code N is set if and only if the source is non-zero and contains a 
minus sign. 

e By appropriate specification of the table, conversion to any form of trailing numeric string may 


be realized. See Chapter 2 for the preferred form of trailing overpunch, zoned and unsigned 
data. In addition, the table may be set up for absolute value, negative absolute value or 
negated conversions. The translation table may be referenced even if the length of the 
destination string is zero. 


° Decimal overflow occurs if the destination string is too short to contain the converted result 
of a non-zero packed decimal source string (not including leading zeroes). Conversion of a 
source string with zero value never results in overflow. Conversion of a non-zero source string 
to a zero length destination string results in overflow. 


e If decimal overflow occurs, the value stored in the destination may be different from the value 
indicated by the condition codes (Z and N bits). 
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CVTSP Convert Leading Separate Numeric to Packed 


Format: 


opcode srclen.rw, srcaddr.ab, dstlen.rw, dstaddr.ab 


Operation: 


{dst 


Condition Codes: 


ASNS 


Exceptions: 


string} <- conversion of {src string} 


{dst string} LSS 0; 
{dst string} EQL 0; 
{decimal overflow}; 
0; 


reserved operand 
decimal overflow 


Opcodes: 


09 CVTSP 


Description: 


Convert Leading Separate Numeric to Packed 


The source numeric string specified by the source length and source address operands is converted to a 
packed decimal string and the destination string specified by the destination address and destination length 
operands is replaced by the result. 


Notes: 


e A reserved operand abort occurs if: 


The length of the source Leading Separate numeric string is outside the range O through 
31. 


The length of the destination packed decimal string is outside the range 0 through 31. 
The source string contains an invalid byte. An invalid byte is any character other than 


an ASCII "0" through "9" in a digit byte or an ASCII "+", "<space>", or "-" in the sign 
byte. 


® After execution: 


INSTRUCTIONS Page 4-189 
Decimal String Instructions 


RO = 0 
Rl = address of the sign byte of the source string 


R2 0 


R3 


address of the byte containing the most significant 
digit of the destination string. 


e The destination string, RO through R3, and the condition codes are UNPREDICTABLE if the 
destination string overlaps the source string, or a reserved operand abort occurs. 
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CVTTP Convert Trailing Numeric to Packed 
Format: 

opcode srclen.rw, srcaddr.ab, tbladdr.ab, dstlen.rw, dstaddr.ab 
Operation: 

{dst string} <- conversion of {src string} 


Condition Codes: 


N <- {dst string}LSS 0; 
Z<- {dst string} EQL 0; 
Vv <- {decimal overflow}; 
C <- Q; 


Exceptions: 


reserved operand 
decimal overflow 


Opcodes: 


26 CVTTP Convert Trailing Numeric to Packed 


Description: 
The source trailing numeric string specified by the source length and source address operands is converted 
to a packed decimal string and the destination packed decimal string specified by the destination address 
and destination length operands is replaced by the result. 
Conversion is effected by using the highest addressed (trailing) byte of the source string as an unsigned 
index into a 256 byte table whose zeroth entry is specified by the table address operand. The byte read 
out of the table replaces the highest addressed byte of the destination string (i.e. the byte containing the 
sign and the least significant digit). The remaining packed digits of the destination string are replaced by 
the low order 4 bits of the corresponding bytes in the source string. 
Notes: 

e A reserved operand abort occurs if: 

1. The length of the source trailing numeric string is outside the range 0 through 31. 


2. The length of the destination packed decimal string is outside the range O through 31. 


3. The source string contains an invalid byte. An invalid byte is any value other than ASCII 
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"0" through "9" in any high order byte (i.e., any byte except the least significant byte). 


4, The translation of the least significant digit produces an invalid packed decimal digit or 


sign nibble. 
e After execution: 
RO = 0 
Rl = address of the most Significant digit of the source 
string 
R2 = 0 


R3 = address of the byte containing the most significant 
digit of the destination string. 


e The destination string, RO through R3, and the condition codes are UNPREDICTABLE if the 
destination string overlaps the source string or the table, or a reserved operand abort occurs. 


° If the convert instruction produces a -0 without overflow, the destination packed decimal string 
is changed to a +0 representation, condition code N is cleared and Z is set. 


e If the length of the source string is 0, the destination packed decimal string is set identically 
equal to 0, and the translation table is not referenced. 


e By appropriate specification of the table, conversion from any form of trailing numeric string 
may be realized. See Chapter 2 for the preferred form of trailing overpunch, zoned and 
unsigned data. In addition, the table may be set up for absolute value, negative absolute value 
or negated conversions. 


e If the table translation produces a sign nibble containing any valid sign, the preferred sign 
representation is stored in the destination packed decimal string. 
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DIVP Divide Packed 
Format: 


opcode divrlen.rw, divraddr.ab, divdlen.rw, 
Givdaddr.ab, quolen.rw, quoaddr.ab 


Operation: 
({quoaddr + ZEXT(quolen/2)} : quoaddr) <- 
({divdaddr + ZEXT(divdlen/2)} : divdaddr) / 
({divraddr + ZEXT(divrlen/2)} : divraddr); 


Condition Codes: 


N <- {quo string} LSS 0; 
Z<- {quo string} EQL 0; 
Vv <- {decimal overflow}; 
Cc <- 0; 


Exceptions: 
reserved operand 
decimal overflow 
divide by zero 
Opcodes: 


27 DIVP Divide Packed 


Description: 

The dividend string specified by the dividend length and dividend address operands is divided by the divisor 
string specified by the divisor length and divisor address operands. The quotient string specified by the 
quotient length and quotient address operands is replaced by the result. 


Notes: 


e This instruction allocates a 16 byte workspace on the stack. After execution SP is restored to 
its original contents and the contents of are UNPREDICTABLE. 


e The division is performed such that: 
1. The absolute value of the remainder (which is lost) is less that the absolute value of the 
divisor. 


2. The product of the absolute value of the quotient times the absolute value of the divisor 
is less than or equal to the absolute value of the dividend. 
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3. The sign of the quotient is determined by the rules of algebra from the signs of the 
dividend and the divisor. If the value of the quotient is zero, the sign is always positive. 
e After execution: 
RO = 0 


Rl = address of the byte containing the most significant 
digit of the divisor string 


R2 = 0 

R3 = address of the byte containing the most significant 
digit of the dividend string 

R4 = 0 

R5 = address of the byte containing the most significant 


digit of the quotient string. 


e The quotient string, RO through R5, and the condition codes are UNPREDICTABLE if the 
quotient string overlaps the divisor or dividend strings, the divisor or dividend string contains 
an invalid nibble, the divisor is 0 or a reserved operand abort occurs. 
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MOVP Move Packed 
Format: 
opcode len.rw, srcaddr.ab, dstaddr.ab 


Operation: 


({dstaddr+ZEXT(len/2)} : dstaddr) <- 
({srcaddr+ZEXT(len/2)} : srcaddr); 


Condition Codes: 


N <- {dst string} LSS 0; 
Z <- {dst string} EQL 0; 
V <- 0; 
Co <= Cs 

Exceptions: 


reserved operand 
Opcodes: 
34 MOVP Move Packed 
Description: 


The destination string specified by the length and destination address operands is replaced by the source 
string specified by the length and source address operands. 


Notes: 
e After execution: 
RO = 0 
Rl = address of the byte containing the most 
Significant digit of the source string 
R2 = 0 
R3 = address of the byte containing the most 


Significant digit of the destination string. 
e The destination string, RO through R3, and the condition codes are UNPREDICTABLE if the 
destination string overlaps the source string, the source string contains an invalid nibble, or a 
reserved operand abort occurs. 


e If the source is -0, the result is +0, N is cleared and Z is set. 
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MULP Multiply Packed 
Format: 


opcode mulrlen.rw, mulraddr.ab, muldlen.rw, 
muldaddr.ab, prodlen.rw, prodaddr.ab 


Operation: 
({prodaddr + ZEXT(prodlen/2)} : prodaddr) <- 


({muldaddr + ZEXT(muldlen/2)} : muldaddr) * 
({mulraddr + ZEXT(mulrlen/2)} : mulraddr); 


Condition Codes: 
N <- {prod string} LSS 0; 
Z<- {prod string} EQL 0; 
V <- {decimal overflow}; 
C <=:0% 


Exceptions: 


reserved operand 
decimal overflow 


Opcodes: 


25 MULP Multiply Packed 


Description: 


The multiplicand string specified by the multiplicand length and multiplicand address operands is multiplied 
by the multiplier string specified by the multiplier length and multiplier address operands. The product string 
specified by the product length and product address operands is replaced by the result. 


Notes: 
e After execution: 
RO = 0 
Rl = address of the byte containing the most 


Significant digit of the multiplier string 


R2 = 0 


R3 address of the byte containing the most 


Significant digit of the multiplicand string 
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R4 = 0 


R5 address of the byte containing the most 


Significant digit of the product string 


e The product string, RO through R5, and the condition codes are UNPREDICTABLE if the 
product string overlaps the multiplier or multiplicand strings, the multiplier or multiplicand strings 
contain an invalid nibble, or a reserved operand abort occurs. 
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SUBP Subtract Packed 


Format: 
opcode sublen.rw, subaddr.ab, diflen.rw, 
difaddr.ab 4 operand 
opcode sublen.rw, subaddr.ab, minlen.rw, 
minaddr.ab, diflen.rw, difaddr.ab 6 operand 
Operation: 


({difaddr + ZEXT(diflen/2)} : difaddr) <- 
({difaddr + ZEXT(diflen/2)} : difaddr) - 
({subaddr + ZEXT(sublen/2)} : subaddr); !4 operand 


({difaddr + ZEXT(diflen/2)} : difaddr) <- 
({minaddr + ZEXT(minlen/2)} : minaddr) - 
({subaddr + ZEXT(sublen/2)} : subaddr); !6 operand 


Condition Codes: 


N <- {dif string} LSS 0; 
Z<- {dif string} EQL 0; 
V <- {decimal overflow}; 
C <- 0; 

Exceptions: 


reserved operand 
decimal overflow 


Opcodes: 


22 SUBP4 Subtract Packed 4 Operand 
23 SUBP6 Subtract Packed 6 Operand 


Description: 


In 4 operand format, the subtrahend string specified by subtrahend length and subtrahend address operands 
is subtracted from the difference string specified by the difference length and difference address operands 
and the difference string is replaced by the result. 


In 6 Operand format, the subtrahend string specified by the subtrahend length and subtrahend address 
operands is subtracted from the minuend string specified by the minuend length and minuend address 
operands. The difference string specified by the difference length and difference address operands is replaced 
by the result. 
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Notes: 
e After execution of SUBP4: 
RO = Q 


Rl 


address of the byte containing the most 
Significant digit of the subtrahend string 


R2 = 0 
R3 = address of the byte containing the most 
Significant digit of the difference string 
° After execution of SUBP6: 
RO = 0 


Rl = address of the byte containing the most 
Significant digit of the subtrahend string 


R2 = 0 

R3 = address of the byte containing the most 
Significant digit of the minuend string 

R4 = 0 

R5 = address of the byte containing the most 


Significant digit of the difference string 


e The difference string, RO through R3 (RO through R5 for SUBP6), and the condition codes 
are UNPREDICTABLE if the difference string overlaps the subtrahend or minuend strings; the 
subtrahend, minuend, or difference (4 operand only) strings contain an invalid nibble; or a 
reserved operand abort occurs. 
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4.13 EDIT INSTRUCTION 


NOTE 


The edit instruction is not implemented by microVAX processors. The edit instruction 
results in an emulated instruction exception on microVAX processors. For more 
details, refer to Appendix B. 


This instruction is designed to implement the common editing functions which occur in handling fixed format 
output. It operates by converting a packed decimal string to a character string. This operation is exemplified 
by a MOVE to a numeric editted (PICTURE) item in COBOL or PL/I, but the instruction can be used for 
other applications as well. The operation consists of converting an input packed decimal number to an 
output character string, generating characters for the output. When converting digits, options include leading 
zero fill, leading zero protection, insertion of floating sign, insertion of floating currency symbol, insertion of 
special sign representations, and blanking an entire field when it is zero. 


The operands to the EDITPC instruction are an input packed decimal string descriptor, a pattern specification, 
and the starting address of the output string. The packed decimal descriptor is a standard VAX operand 
pair of the length of the decimal string in digits (up to 31) and the starting address of the string. The 
pattern specification is the starting address of a pattern operation editing sequence which is interpreted 
much the way that the normal instructions are. The output string is described by only its starting address 
because the pattern defines the length unambiguously. 


While the EDITPC instruction is operating, it manipulates two character registers and the four condition 
codes. One character register contains the fill character. This is normally an ASCII blank, but would be 
changed to asterisk for check protection. The other character register contains the sign character. Initially 
this contains either an ASCII blank or a minus sign depending upon the sign of the input. This can be 
changed to allow other sign representations such as plus/minus or plus/blank and can be manipulated in 
order to output special notations such as CR or DB. The sign register can also be changed to the currency 
sign in order to implement a floating currency sign. After execution, the condition codes contain the sign 
of the input (N), the presence of a zero source (Z), an overflow condition (V), and the presence of significant 
digits (C). Condition code N is determined at the start of the instruction and is not changed thereafter 
(except for correcting a -0 input). The other condition codes are computed and updated as the instruction 
proceeds. When the EDITPC instruction terminates, registers RO-R5 contain the conventional values after a 
decimal instruction. 
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EDITPC Edit Packed to Character String 
Format: 

opcode srclen.rw, srcaddr.ab, pattern.ab, dstaddr.ab 
Operation: 


if srclen GTRU 31 then {reserved operand abort}; 

PSW<V,C> <- 0; 

PSW<Z> <- 1; 

PSW<N> <- {src has minus sign}; 

RO <- srclen; 

tmpl <- RQ; 

Rl <- srcaddr; 

R2<15:8> <- {if PSW<N> EQL 0 then " " else "-"} ! sign of src 
{R2<7:0> is used for the fill character 

R3 <- pattern; 

R5 <- dstaddr; 

exit flag <- false; 


while NOT exit _flag do 

begin 

{fetch pattern byte}; 

{if pattern 0:4 no operand}; 

{if pattern 40:47 increment R3 and 
fetch one byte operand}; 

{if pattern 80:AF except 80, 90, AO 
operand is rightmost nibble}; 

{else {reserved operand fault}}; 

{perform pattern operator}; 

if NOT exit flag then {increment R3}; 

end: 


if RO NEQ O then {reserved operand abort}; 
RO <- tmp1; !length of source string 


Rl <- R1 - {tmpl1/2} {point to start of source string 
R2 <- 0; 
R4 <- 0; 


g 
1f PSW<Z> EQL 1 then PSW<N> <- 0; 


Condition Codes: 


N <- {src string} LSS 0; IN <- 0 if src is -0 
Z<- {src string} EQL 0; 

V <- {decimal overflow}; {non-zero digits lost 
C <- {significance}; 


Exceptions: 
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reserved operand 
decimal overflow 


Opcodes: 


38 EDITPC Edit Packed to Character String 


Description: 


The destination string specified by the pattern and destination address operands is replaced by the editted 
version of the source string specified by the source length and source address operands. The editing is 
performed according to the pattern string starting at the address pattern and extending until a pattern end 
(EOSEND) pattern operator is encountered. The pattern string consists of one byte pattern operators. Some 
pattern operators take no operands. Some take a repeat count which is contained in the rightmost nibble 
of the pattern operator itself. The rest take a one byte operand which follows the pattern operator immediately. 
This operand is either an unsigned integer length or a byte character. The individual pattern operators are 
described on the following pages. 


Notes: 
e A reserved operand abort occurs if srclen GTRU 31. 
e The destination string is UNPREDICTABLE if the source string contains an invalid nibble, if 


the EOSADJUST _INPUT operand is outside the range 1 through 31, if the source and destination 
strings overlap, or if the pattern and destination strings overlap. 


e After execution: 

RO = length of source string 

Rl = address of the byte containing the most 
Significant digit of the source string 

R2 = 0 

R3 = address of the byte containing the EOSEND 
pattern operator 

R4 = 0 


R5 = address of one byte beyond the last byte 
of the destination string 


If the destination string is UNPREDICTABLE, RO through R5 and 
the condition codes are UNPREDICTABLE. 


e If V is set at the end and DV is enabled, numeric overflow trap occurs unless the conditions 
in note 9 are satisfied. 


e The destination length is specified exactly by the pattern operators in the pattern string. If the 
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pattern is incorrectly formed or if it is modified during the execution of the instruction, the 
length of the destination string is UNPREDICTABLE. 


e If the source is -0, the result may be -O unless a fixup pattern operator is included 
(EOS$BLANK_ZERO or EOSREPLACE_ SIGN). 


e The contents of the destination string and the memory preceding it are UNPREDICTABLE if 
the length covered by EO$BLANK_ZERO or EO$REPLACE_SIGN is O or is outside the 
destination string. 


e If more input digits are requested by the pattern than are specified, then a reserved operand 
abort is taken with RO = -1 and R3 = location of pattern operator which requested the extra 
digit. The condition codes and other registers are UNPREDICTABLE. This abort is not 
continuable. 

e If fewer input digits are requested by the pattern than are specified, then a reserved operand 


abort is taken with R3 = location of EOSEND pattern operator. The condition codes and other 
registers are UNPREDICTABLE. This abort is not continuable. 


e On an unimplemented or reserved pattern operator, a reserved operand fault is taken with R3 
= location of the faulting pattern operator. This fault is continuable as long as the defined 
register state is manipulated according to the pattern operator description and the state specified 
as implementation dependent is preserved. FPD is set and the condition codes and registers 
are as follows: 


N = {src has minus sign} 

Z = all source digits 0 so far 

V = non-zero digits lost 

C = significance 

RO<31:16> = -{count of source zeros to supply} 


RO<15:0> = remaining srclen<15:0> 
Rl = current source location 
R2<31:16> = implementation dependent 


R2<15:8> = current contents of Sign character register 
R2<7:0> = current contents of fill character register 


R3 = location of edit pattern operator causing exception 
R4 = implementation dependent 
R5 = location of next destination byte 
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Summary of EDIT pattern operators 


name operand 
insert: 

EOS INSERT ch 

EOSSTORE SIGN - 

EOSFILL r 
move: 

EOSMOVE r 

EOSFLOAT r 

EOSEND FLOAT - 
fixup: 

EOSBLANK ZERO len 

EOSREPLACE SIGN len 
load: 

EOS LOAD FILL ch 

EOSLOAD SIGN ch 

EOSLOAD PLUS ch 

EOSLOAD MINUS-~— ch 
controls: 


EOSSET SIGNIF- - 
EOSCLEAR SIGNIF - 
EOSADJUST INPUT len 


EOSEND = 
where: 

ch = 

r = 

len = 


summary 


insert character, fill if insignificant 
insert Sign 
insert fill 


move digits, filling insignificant 
move digits, floating sign 
end floating sign 


fill backward when zero 
replace with fill if -0 


load fill character 
load sign character 
load sign character if positive 
load sign character if negative 


set significance flag 
clear significance flag 
adjust source length 
end edit 


one character 
repeat count in the range 1 through 15 
length in the range 1 through 255 
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(hex) 
00 
01 
02 
03 
04 

05..1F 


20..3F 


48..5F 
60..7F 


80,90,A0 


81..8F 
Slee oe 
Al..AF 


BO..FE 
FF 


EDIT pattern operator encoding 


EOSEND 


EOSEND_ FLOAT 
EOSCLEAR_SIGNIF 
EOSSET_ SIGNIF 
EOSSTORE SIGN 


Reserved to DEC 
Reserved for all time 
EOSLOAD FILL \ 


EOSLOAD SIGN | 


EOSLOAD PLUS 


EOSLOAD MINUS | 


EOS INSERT 


/ 


EOSBLANK ZERO \ 


EOSREPLACE SIGN 


EOSADJUST_ INPUT 


Reserved 
Reserved 


Reserved 
EOSFILL 
EOSMOVE 
EOSFLOAT 


Reserved 
Reserved 


to DEC 
to CSS, customers 


to DEC 
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|-- character is in next byte 


|-- unsigned length is in next byte 


|-- repeat count is <3:0> 


to DEC 
for all time 
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The following pages define each pattern operator in a format similar to that of the normal instruction 
descriptions. In each case, if there is an operand it is either a repeat count (r) from 1 through 15, an 
unsigned byte length (len), or a character byte (ch). In the formal descriptions, the following two routines 
are invoked: 


READ: !function value 0 through 9 
if RO EQL O then {reserved operand}; 


if RO LSS O then 
begin 
READ <- 0; 
RO<31:16> <- RO<31:16> + 1; !see EOSADJUST_INPUT 
end; 
else 
begin 
READ <- (R1)<3+4*R0<0>:4*RO<0>>; !get next nibble 
falternating high then low 
RO <- RO - 1; 
if RO<O> EQL 1 then RI <- Rl +1; 
end; 
return; 


STORE(char): 
(R5) <- char; 
R5 <- RS + 1; 
return; 


Also the following definitions are used: 


fill R2<73Q> 


sign R2<15:8> 
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EOSADJUST_INPUT Adjust Input Length 
Purpose: 
Handle source strings with lengths different from the output 
Format: 
pattern len 
Operation: 
if len EQLU 0 or len GTRU 31 then {UNPREDICTABLB}; 
if RO<15:0> GTRU len 
then 
begin 
RO<31:16> <- Q 


repeat R0O<15:0> - len do 
if READ NEQU 0 then 


begin 

PSW<Z> <- Q; 

PSW<C> <- 1; !set Significance 
PSW<V> <- 1; 

end; 


end; 
else RO<31:16> <- RO<15:0> - len; !negative of number to fill 


Pattern operators: 


47 EOSADJUST_ INPUT Adjust Input Length 


Description: 


The pattern operator is followed by an unsigned byte integer length in the range 1 through 31. If the source 
string has more digits than this length, the excess leading digits are read and discarded. If any discarded 
digits are non-zero then overflow is set, significance is set, and zero is cleared. If the source string has 
fewer digits than this length, a counter is set of the number of leading zeros to supply. This counter is 
stored as a negative number in R0<31:16>. 


Notes: 


If length is not in the range 1 through 31 the destination 
string, condition codes, and RO through R5 are UNPREDICTABLE. 
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EOSBLANK ZERO £Blank Backwards When Zero 
Purpose: 
Fixup the destination to be blank when the value is zero 
Format: 
pattern len 
Operation: 
if len EQLU 0 then {UNPREDICTABLE}; 
1f PSW<Z> EQL 1 then 
begin 
R5 <- R5 - len; 
repeat len do STORE(fill); 
end: 


Pattern operators: 


45 EOSBLANK ZERO Blank Backwards When Zero 


Description: 
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The pattern operator is followed by an unsigned byte integer length. If the value of the source string is 
zero, then the contents of the fill register is stored into the last length bytes of the destination string. 


Notes: 


e The length must be non-zero and within the destination string already produced. lf it is not, 
the contents of the destination string and the memory preceding it are UNPREDICTABLE. 


e This pattern operator is used to blank out any characters stored in the destination under a 


forced significance, such as a sign or the digits following the radix point. 
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EOSEND End Edit 
Purpose: 
End the edit operation 
Format: 
pattern 
Operation: 
exit flag <- true; !terminate edit loop 
fend processing is 
!described under EDITPC instruction 


Pattern operators: 


00 EOSEND End Edit 


Description: 
The edit operation is terminated. 
Notes: 
e lf there are still input digits a reserved operand abort is taken. 


e If the source value ts -0, the N condition code is cleared. 
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EOSEND_ FLOAT End Floating Sign 
Purpose; 
End a floating sign operation 
Format: 
pattern 
Operation: 


if PSW<C> EQL O then 


begin 

STORE(sign); 

PSW<C> <- 1; !set significance 
end; 


Pattern operators: 


01 EOSEND_ FLOAT End Floating Sign 


Description: 


If the floating sign has not yet been placed in the destination (i.e., if significance is not set), the contents 
of the sign register is stored in the destination and significance is set. 


Notes: 


This pattern operator is used after a sequence of one or more 
EOS$FLOAT pattern operators which start with significance clear. 
The EO$FLOAT sequence can include intermixed EO$SINSERTs and 
EOS$FILLs. 
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EOSFILL Store Fill 
Purpose: 
Insert the fill character 
Format: 

pattern r 
Operation: 

repeat r do STORE(fill); 
Pattern operators: 


8x EOSFILL Store Fill 


Description: 


The right nibble of the pattern operator is the repeat count. The contents of the fill register is placed into 
the destination repeat times. 


Notes: 


This pattern operator is used for fill (blank) insertion. 
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EOSFLOAT Float Sign 
Purpose: 
Move digits, floating the sign across insignificant digits 
Format: 
pattern ig 
Operation: 
repeat r do 
begin 


tmp <- READ; 
if tmp NEQU O then 


begin 
if PSW<C> EQL 0 then 
begin 
STORE(sign); 
PSW<Z> <- 0; 
PSW<C> <- 1; {set Significance 
end; 
end; 


if PSW<C> EQL 0 then STORE( fill) 
else STORE("0" + tmp); 
end; 


Pattern operators: 


Ax EOSFLOAT Float Sign 


Description: 


The right nibble of the pattern operator is the repeat count. For repeat times, the following algorithm is 
executed. The next digit from the source is examined. If it is non-zero and significance is not yet set, then 
the contents of the sign register is stored in the destination, significance is set, and zero is cleared. If the 
digit is significant, it is stored in the destination, otherwise the contents of the fill register is stored in the 
destination. 


Notes: 


e If r is greater than the number of digits remaining in the source string, a reserved operand 
abort is taken. 


° This pattern operator is used to move digits with a floating arithmetic sign. The sign must 
already be setup as for EOSSTORE_SIGN. A sequence of one or more EO$FLOATs can 
include intermixed EO$SINSERTs and EOSFILLs. Significance must be clear before the first 
pattern operator of the sequence. The sequence must be terminated by one EOSEND_FLOAT. 
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This pattern operator is used to move digits with a floating currency sign. The sign must 
already be setup with a EOSLOAD_SIGN. A sequence of one or more EO$FLOATs can include 
intermixed EO$INSERTs and EO$FILLs. Significance must be clear before the first pattern 
operator of the sequence. The sequence must be terminated by one EOQ$END_FLOAT. 
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EOS INSERT Insert Character 
Purpose: 
Insert a fixed character, substituting the fill character if not significant 
Format: 
pattern ch 
Operation: 
if PSW<C> EQL 1 then STORE(ch) else STORE(fill1); 
Pattern operators: 


44 EOSINSERT Insert Character 


Description: 


Page 4-213 


The pattern operator is followed by a character. If significance is set, then the character is placed into the 
destination. If significance is not set, then the contents of the fill register is placed into the destination. 


Notes: 


This pattern operator is used for blankable inserts (e.g., 
comma) and fixed inserts (e.g., slash). Fixed inserts require 
that significance be set (by EOSSET_SIGNIF or EOSEND_FLOAT). 
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FOSLOAD_ 


Purpose: 


Change the contents of the fill or sign register 


Format: 


pattern ch 


Page 4-214 


Load Register 


Operation: !select one depending on pattern operator 


fill <- ch; 


Sign <- ch; 


if PSW<N> EQL O then 


if PSW<N> EQL 1 then 


Pattern operators: 


40 EOSLOAD FILL 
41 EOS$LOAD_SIGN 
42 EOSLOAD PLUS 
43 EOSLOAD MINUS 


Description: 


Load 
Load 
Load 
Load 


!EROSLOAD FILL 


!EOSLOAD_ SIGN 


sign 


sign 


Fill 
Sign 
Sign 
Sign 


<- ch; !EOSLOAD PLUS 
<- ch; !EOSLOAD MINUS 
Register 
Register 


Register If Plus 
Register If Minus 


The pattern operator is followed by a character. For EO$LOAD_FILL this character is placed into the fill 
register. For EO$LOAD_SIGN this character is placed into the sign register. For EO$LOAD_PLUS this 
character is placed into the sign register if the source string has a positive sign. For EO$LOAD_MINUS 
this character is placed into the sign register if the source string has a negative sign. 


Notes: 


° EO$LOAD_FILL is used to setup check protection (* instead of space). 


e EO$LOAD_SIGN is used to setup a floating currency sign. 


° EO$LOAD_PLUS is used to setup a non-blank plus sign. 


e EO$LOAD_MINUS is used to setup a non-minus minus sign (such as CR, DB, or the PL/I 


+). 
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EOSMOVE Move Digits 
Purpose: 
Move digits, filling for insignificant digits (leading zeros) 
Format: 
pattern r 
Operation: 
repeat r do 
begin 


tmp <- READ; 
if tmp NEQU O then 


begin 

PSW<Z> <- 0; 

PSW<C> <- 1; {set significance 
end: 


if PSW<C> EQL 0 then STORE(fill) 
else STORE("0" + tmp); 
end; 


Pattern operators: 


9x EOSMOVE Move Digits 


Description: 


The right nibble of the pattern operator is the repeat count. For repeat times, the following algorithm is 
executed. The next digit is moved from the source to the destination. If the digit is non-zero, significance 
is set and zero is cleared. If the digit is not significant (i.e., is a leading zero) it is replaced by the contents 
of the fill register in the destination. 


Notes: 
e If r is greater than the number of digits remaining in the source string, a reserved operand 
abort is taken. 
° This pattern operator is used to move digits without a floating sign. If leading zero suppression 


is desired, significance must be clear. If leading zeros should be explicit, significance must be 
set. A string of EOSMOVEs intermixed with EOSINSERTs and EOS$FILLs will handle suppression 
correctly. 


° If check protection (*) is desired EO$LOAD_FILL must precede the EO$MOVE. 
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EOSREPLACE SIGN Replace Sign When Zero 
Purpose: 
Fixup the destination sign when the value is zero 
Format: 
pattern len 
Operation: 


if len EQLU 0 then {UNPREDICTABLE}  ; 
if PSW<Z> EQL 1 then (R5 - len) <- fill; 


Pattern operators: 


46 EOSREPLACE SIGN Replace Sign When Zero 


Description: 
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The pattern operator is followed by an unsigned byte integer length. If the value of the source string is 
zero (i.e., if Z is set), then the contents of the fill register is stored into the byte of the destination string 


which is length bytes before the current position. 


Notes: 


° The length must be non-zero and within the destination string already produced. If it is not, 
the contents of the destination string and the memory preceding it are UNPREDICTABLE. 


° This pattern operator can be used to correct a stored sign (EOS$END_FLOAT or 
EO$STORE_SIGN) if a minus was stored and the source value turned out to be zero. 
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EO$_SIGNIF Significance 
Purpose: 


Control the significance (leading zero) indicator 


Format: 
pattern 

Operation: 
PSW<C> <- 0; !EOSCLEAR_SIGNIF 
PSW<C> <- 1; !EOSSET SIGNIF 


Pattern operators: 


02 EOSCLEAR SIGNIF Clear Significance 
03 EOSSET SIGNIF Set Significance 
Description: 
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The significance indicator is set or cleared. This controls the treatment of leading zeros (leading zeros are 


zero digits for which the significance indicator is clear). 


Notes: 


e EO$CLEAR_SIGNIF is used to initialize leading zero suppression (EO$MOVE) or floating sign 


(EOSFLOAT) following a fixed insert (EOSINSERT with significance set). 


° EO$SET_SIGNIF is used to avoid leading zero suppression (before EOSMOVE) or to force a 


fixed insert (before EO$INSERT). 
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EOSSTORE SIGN Store Sign 
Purpose: 
Insert the sign character 
Format: 
pattern 
Operation: 
STORE(sign) ; 
Pattern operators: 


04 EOSSTORE SIGN Store Sign 


Description: 
The contents of the sign register is placed into the destination. 
Notes: 


This pattern operator is used for any non-floating arithmetic 
sign. It should be preceded by a EO$LOAD_PLUS and/or 


EO$LOAD_MINUS if the default sign convention is not desired. 
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4.14 OTHER VAX INSTRUCTIONS 


The following instructions are specified in other chapters of this document as indicated below. 


° Chapter 5: 


Probe {Read, Write} Accessability 
PROBE{R,W} mode.rb, len.rw, base.ab 


e Chapter 6: 
Change Mode 
CHM{K,E,S,U} param.rw, {-(ySP).w*} 
Where y=MINU(x, PSL<current_mode>) 


Return from Exception or Interrupt 
REI {(SP)+.r*} 


° Chapter 7: 


Load Process Context 
LDPCTX {PCB.r*, -(KSP).w*} 


Save Process Context 
SVPCTX {(SP)+.r*, PCB.w*} 


° Chapter 9: 


Move To Process Register 
MTPR srce.rl, procreg.rl 


Move From Processor Register 
MFPR procreg.rl, dst.wl 
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BUG Bugcheck 
Format: 
opcode message.bx 
Operation: 
{fault to report error} 


Condition Codes: 


N <- N;3 
Lh s= Ze 
V <- V; 
C <= Cs 


Exceptions: 
reserved instruction 
Opcodes: 


FEFF BUGW Bugcheck with word message identifier 
FDFF BUGL Bugcheck with longword message identifier 


Description: 


The hardware treats these opcodes as RESERVED to DIGITAL and faults. The VAX/VMS operating system 
treats these as requests to report software detected errors. The in-line message identifier is zero extended 
to a longword (BUGW) and interpreted as a condition value (see Appendix C, VAX/VMS Run Time Library 
Reference Manual). If the process is privileged to report bugs, a log entry is made. If the process is not 
privileged, a reserved instruction is signalled. 


[End of Chapter 4] 


CHAPTER 5 


MEMORY MANAGEMENT 


5.1 INTRODUCTION 


Memory management consists of the hardware and software which control the allocation and use of physical 
memory. Typically, in a multiprogramming system, several processes may reside in physical memory at the 
same time. VAX uses memory protection and multiple address spaces to ensure that one process will not 
affect other processes or the operating system. 


To further improve software reliability, four hierarchical access modes provide memory access control. They 
are, from most to least privileged: kernel, executive, supervisor, and user. Protection is specified at the 
individual page level, where a page may be inaccessible, read-only, or read/write for each of the four access 
modes. Any location accessible to one mode is also accessible to all more privileged modes. Furthermore, 
for each access mode, any location that can be written can also be read. 


The CPU generates virtual addresses when an image is executed. However, before these addresses can 
be used to access instructions and data, they must be translated into physical addresses. Memory management 
software maintains tables of mapping information (page tables) that keep track of where each 512-byte virtual 
page is located in physical memory. The CPU utilizes this mapping information when it translates virtual 
addresses to physical addresses. 


Therefore, memory management is the scheme that provides both the memory protection and memory 
mapping mechanisms of VAX. The memory management meets several development goals: 


e Provide a large address space for instructions and data. 

e Allow data structures up to one gigabyte. 

e Provide convenient and efficient sharing of instructions and data. 
e Contribute to software reliability. 


A virtual memory system provides a large address space, yet allows programs to run on hardware with 
small memory configurations. Programs execute in an environment termed a process. The virtual memory 
system for VAX provides each process with a 4 billion byte address space. 


The virtual address space is divided into two equal size spaces, the system address space and the per-process 
address space. The system address space is the same for all processes. It contains the operating system 
which is written as callable procedures. Thus all system code can be available to all other system and user 
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code via a simple CALL. Each process has its own separate process address space. However, several 
processes may have access to the same page, thus providing controlled sharing. 


5.2 VIRTUAL ADDRESS SPACE 


A virtual address is a 32 bit unsigned integer specifying a byte location in the address space. The programmer 
sees a linear array of 4,294,967,296 bytes. The virtual address space is broken into 512 byte units termed 
pages. The page is the unit of relocation and protection. 


This virtual address space is too large to be contained in any presently available main memory. Memory 
management provides the mechanism to map the active part of the virtual address space to the available 
physical address space. Memory management also provides page protection between processes. The operating 
system controls the virtual-to-physical address mapping tables, and swaps the inactive but used parts of the 
virtual address space onto the external storage media. 


The virtual address space is divided into two parts. The half with the smaller addresses, known as "per-process 
space,’ is distinct for each process running on the system. The half with the larger addresses, known as 
"system space," is shared by all processes. Virtual address space is illustrated in Figure 5-1. 
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Virtual Address Space 
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5.2.1 Process Space 


The smaller-addressed half (addresses O0000000-7FFFFFFF, hex) of the virtual address space is termed 
"per-process space." The per-process space is divided into two equal parts, the program region (PO region) 
and the control region (P1 region). Each process has a separate address translation map for per-process 
space, so the per-process spaces of all processes are completely disjoint (see the section on Sharing at 
the end of this chapter). The address map for per-process space is context switched (changed) when the 
process running on the system is changed (see the chapter on Process Structure). 


5.2.2 System Space 


The larger-addressed half (addresses 80000000-FFFFFFFF, hex) of the virtual address space is termed 
"system space." All processes use the same address translation map for system space, so system space is 
shared among all processes. The address map for system space is not context switched. 


5.2.3 Virtual Address Format 


The VAX processor generates a 32-bit virtual address for each instruction and operand in memory. As the 
process executes, the system translates each virtual address to a physical address. The virtual address has 
the following format: 


3 
1 98 0) 
Figure 5-2 
Virtual Address Format 
VPN €31:9> The Virtual Page Number field specifies the virtual page to be referenced. 
The virtual address space contains 8,388,608 (2**23) pages of 512 bytes 
each. 
Byte # <8:0> The byte number field specifies the byte address within the page. A 


page contains 512 bytes. 


When bit 31 is one, the address is in the system space. When bit 31 is zero, the address is in the 
per-process space. 


Within the per-process space, bit 30 distinguishes between the program and control regions. When bit 30 
is one, the control region is referenced, and when it is zero, the program region is referenced. 
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5.2.4 Virtual Address Space Layout 


The layout of virtual address space is illustrated in Figure 5-1. Note that access to each of the three regions 
(PO, P1, System) is controlled by a length register (POLR, P1LR, SLR). Within the limits set by the length 
registers, the access is further controlled by page tables that specify the validity, access requirements, and 
physical location of each page in the memory. 


5.3 MEMORY MANAGEMENT CONTROL 


The action of translating a virtual address to a physical address is governed by the setting of the Memory 
Mapping Enable (MME) bit in the MAPEN internal processor register. Figure 5-3 illustrates the privileged 
MAP ENable register. 


Figure 5-3 

MAP ENable Register (MAPEN) 
( to read: MFPR #56, dst.wl ) 
( to write: MTPR src.rl, #56 ) 


MAPENX<O> is the Memory Mapping Enable (MME) bit. When MME is set to 1, memory management is 
enabled. When MME is set to 0, memory management is disabled. 


At processor initialization time, MAPEN is initialized to 0. 


5.3.1 Memory Management Disabled 
Setting MME to O turns off address translation and access control. Virtual address bit n, VA<n>, is copied 
directly to the corresponding physical address bit, PA<n>, for n = 0O to 29. VA<31:30> are ignored; 
PA<31:30> do not exist. VA<n> is ignored if PA<n> doesn’t exist. (The number of PA bits is implementation 
dependent.) 

PA = VA<29:0> modulo (2** number of PA bits) 


There is no page protection: all accesses are allowed in all modes. No modify bit is maintained. 
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5.4 ADDRESS TRANSLATION 


When MME is a 1, address translation and access control are on. The processor uses the following to 
determine whether an intended access is allowed: 


e The virtual address, which is used to index a page table, 
e The intended access type (read or write), and 
e The current privilege level from the Processor Status Longword, or Kernel level for page table 


mapping references. 


If the access is allowed and the address can be mapped, the result is the physical address corresponding 


to the specified virtual address. 


The intended access is READ if the operation to be performed is a read. The intended access is WRITE 
if the operation to be performed is a write. If the operation to be performed is a modify (that is, read 
followed by write) the intended access is specified as a WRITE. 


lf an operand is an address operand, then no reference is made. Hence the page need not be accessible 


and need not even exist. 


5.4.1 Page Table Entry (PTE) 


The CPU uses a Page Table Entry (PTE) to translate virtual addresses to physical addresses. Figure 5-4a 


illustrates the PTE format. 


3 3 22222222 
10 76543210 0 
i esor_[ofous]s mn 
Figure 5-4a 
Page Table Entry 
V <31> Valid bit - governs the validity of the M bit and PFN field. V=1 for 
valid; V=0 for not valid. When V=0, the M and PFN fields are reserved 
for DIGITAL software. 
PROT <30:27> PROTection field - this field is always valid and is used by the CPU 
hardware even when V=0O. 
M <26> Modify bit - When the Valid bit is clear, M is not used by CPU hardware, 


and is reserved for DIGITAL software and I/O devices. When the Valid 
bit is set, M shows whether the page has been modified. If M is clear, 
the page has not been modified. If M is set, the page may have been 
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modified. 


M is cleared only by software. It is set by CPU hardware on a successful 
write or modify to the page. In addition, it may be set by the probe-write 
instruction (PROBEW) or by an implied probe-write. M is not set if the 
page is inaccessible. Beyond that, it is UNPREDICTABLE whether M is 
set if a fault occurs in an instruction which would otherwise have modified 
the page. 


For example, if a write reference crosses a page boundary where the 
first page is not accessible and the second page is accessible, the 
reference will fault. M is unchanged in the PTE mapping the first page. 
It is UNPREDICTABLE whether M is set in the PTE mapping the second 


page. 


It is UNPREDICTABLE whether the modification of a process PTE<M> 
bit causes modification of the system PTE that maps that process page 
table. Note that the update of the M bit is not interlocked in a 
multiprocessor system. 


OWN €24:23> OWNer bits - reserved for DIGITAL software use as the access mode 
of the owner of the page (that is, the mode allowed to alter the page 
protection or to delete the page); not examined or altered by any 
hardware. 


PFN <20:0> Page Frame Number - the upper 21 bits of the physical address of the 
base of the page. Used by CPU hardware only if V=1. 


Z <25> Zero bit - bit 25 is reserved to DIGITAL and must be zero. The hardware 
does not necessarily test that this bit is zero because the PTE is 
established by privileged software. 


S €22:21> Software bits - bits 22 and 21 are reserved for DIGITAL software. 
(Software symbols defined for the above fields use PTE$ as the prefix.) 


The operating system software uses some combinations of the software bits to implement its page management 
data structures and functions. Among the functions implemented this way are _ initialize-pages-with-zeros, 
copy-on-reference, page sharing, and transitions between active and swapped-out states. VAX/VMS encodes 
these functions in PTEs whose Valid bit, PTE<31>, is a 0 and processes them whenever a page fault 
occurs. 


5.4.2 Page Table Entry (PTE) For I/O Devices 


Some I/O devices, such as the DR32, use VAX memory management to translate addresses. These I/O 
devices use a Page Table Entry format which is an extension of that in Figure 5-4a used by the CPU. The 
extended PTE implements for I/O hardware some functions that the CPU does with software using software 
bits and page faults. In particular, PTE bits 31, 26, and 22 are decoded into four combinations. Some of 
these are used in the same way as in the CPU PTE format, and some are used in different ways. The 
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four combinations are: 


PTE<31,26,22> PTE Type 


Valid PFN 

Valid PFN 

Global Page Table Index 
Invalid, I/O abort 


OOOF 
HOO x 
xr OM 


and their interpretations are: 


PTE<31,26,22> = 1xx, Figure 5-4b. PTE<20:0> is a valid PFN field. This is identical to the PFN field illustrated 
in Figure 5-4a for the CPU PTE. 

3 3 2222-222 2 

1 0 76543210 0 


Tor elon mn 


Figure 5-4b 
PTE<31,26,22> = 1xx, Valid PFN 


PTE<31,26,22> =000, Figure 5-4c. PTE<20:0> is a valid PFN field. This is identical to the PFN field illustrated 
in Figure 5-4a for the CPU PTE. 

3 3 22222222 

1 0 76543210 0 


iL mor [o[onls mn 


Figure 5-4c 
PTE<31,26,22>=000, Valid PFN 


PTE<31,26,22>=001, Figure 5-4d. PTE<21:0> is a Global Page Table Index (GPTX). The I/O device has 
a Global page table Base Register (GBR) which is loaded by software with a system virtual address. The 
I/O device calculates GBR + GPTX * 4 to get the system virtual address of a second PTE. The second 
PTE must contain a valid PFN, and must have PTE<31,26,22> equal to either 000 or 1xx, binary. If either 
of these requirements is not met, the result is UNDEFINED. For those devices that use it, the PROTection 
field always comes from the first PTE. 
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Figure 5-4d PTE<31,26,22>=001, Global Page Table Index 


3 
1 


PTE<31,26,22>=01x, Figure 5-4e. This PTE format is RESERVED to DIGITAL. I/O devices will abort in a 
DEVICE DEPENDENT manner. 


a3 22222222 

1 0 76543210 0) 

ol rot |z}zfomfsjs) 
Figure 5-4e 


PTE<31,26,22> =01x, Invalid, I/O abort 


I/O devices may look at and check the PROTection field or modify the M bit; this is DEVICE DEPENDENT. 
Those devices that do use them, use them the same way the CPU does. 


/(O devices that do memory mapping use the same SPT as the CPU, but they have their own copies of 
the SBR and SLR. Buffer addresses are described in terms of a system virtual address of the PTE for the 
first buffer page and a byte offset within that page. In addition the I/O devices use a Global Page Table 
in memory and an I/O hardware Global page table Base Register (GBR) which must be loaded by software. 


5.4.3 Changes To Page Table Entries 


The operating system changes PTEs as part of its memory management functions. For example, VMS sets 
and clears the valid bit and changes the PFN field as pages are swapped in and out. 


The software must guarantee that each PTE is always consistent within itself. Changing a PTE one field at 
a time may give incorrect system operation. An example would be to set PTE<V> with one instruction 
before establishing PTE<PFN> with another. An interrupt routine between the two instructions could use an 
address that would map using the inconsistent PTE. The software can solve this problem by building a new 
PTE in a register and then moving the new PTE to the page table with a single instruction such as MOVL. 


Multiprocessing makes the problem more complicated. Another processor, be it another CPU or an I/O 
processor, can reference the same page tables that the first CPU is changing. The second processor must 
always read consistent PTEs. In order to guarantee this, first note that PTEs are longwords, longword-aligned. 
Then two requirements must be met: 


e Whenever the software modifies a PTE in more than one byte, it must use a longword, 
longword-aligned, write-destination instruction, such as MOVL, and 
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° The hardware must guarantee that a longword, longword-aligned write is an "atomic" operation. 


That is, a second processor cannot read (or write over) any of the first processor’s partial 
results. 


5.5 ACCESS CONTROL 
Access control is the function of validating whether a particular type of memory access is to be allowed to 
a particular page. Access to each page is controlled by a protection code that specifies for each access 


mode whether or not read or write references are allowed. Additionally, each address is checked to make 
certain that it lies within the PO, P1, or system region. 


5.5.1 Processor Modes 
In the order of most privileged to least privileged, the four processor modes are: 
QO - Kernel - used by the kernel of the operating system for page 
management, scheduling, and I/O drivers. 


1 - Executive - used for many of the operating system service 
calls, including the record management system. 


2 - Supervisor - used for such services as command interpretation. 


3 - User - used for user. level code, utilities, compilers, 
debuggers, etc. 


The access mode of a running process is the current processor mode, stored in the Current Mode field of 
the Processor Status Longword (PSL) (see the Chapter on Exceptions and Interrupts). 


5.5.2 Protection Code 


Every page in the virtual address space is protected according to its use. Even though all of the system 
space is shared, in that the program may generate any address, the program may be prevented from 
modifying, or even accessing portions of it. A program may also be prevented from accessing or modifying 
portions of per-process space. 


For example, in system space, scheduling queues are highly protected, whereas library routines may be 
executable by code of any privilege. Similarly per-process accounting information may be in per-process 
space, but highly protected, while normal user code in per-process spaces is executable at low privilege. 


Associated with each page is a protection code that describes the accessibility of the page for each processor 
mode. The code allows a choice of protection for each processor mode, within the following limits: 


e Each level’s access can be read-write, read-only, or no-access. 
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e If any level has read access then all more privileged levels also have read access. 
e If any level has write access then all more privileged levels also have write access. 


The protection codes for the 15 combinations of page protection are encoded in a 4 bit field in the Page 
Table Entry as shown in Figure 5-5. 


CODE MNEMONIC PRIVILEGE LEVEL COMMENT 
DECIMAL BINARY K B S U 
0 0000 NA - - - _ no ACCESS 
1 0001 UNPREDICTABLE RESERVED 
2 0010 KW RW = = 7 
3 0011 KR R - - - 
4 0100 UW RW RW RW RW ALL ACCESS 
5 0101 EW RW RW = - 
6 0110 ERKW RW R - - 
7 0111 ER R R - ~ 
8 1000 SW RW RW RW = 
9 1001 SREW RW RW R - 
10 1010 SRKW RW R R - 
bd 1011 SR R R R - 
12 1100 URSW RW RW RW R 
13 1101 URBEW RW RW R R 
14 1110 URKW RW R R R 
15 1111 UR R R R R 
Key 
- - no access K - Kernel 
R - read only E - Executive 
RW - read write S - Supervisor 
U - User 


Figure 5-5 
Protection Mnemonics 


(Software symbols are defined by using PTESK_ as a prefix to the above mnemonics.) 


This encoding was chosen to simplify hardware access checking for implementations not using a table 
decoder. The access is allowed if: 


{CODE NEQU 0} AND 
{{CODE EQLU 4} OR {CM LSSU WM} OR {READ AND {CM LEQU RM}}} 


CM iS current processor mode 
RM is left 2 bits of code 
WM is one's complement of right 2 bits of code 
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5.5.3 Length Violation 


Every valid virtual address lies within bounds determined by the addressing region (PO, P1, or System) and 
the associated length register (POLR, P1LR, or SLR). Virtual addresses outside these bounds cause a length 
violation. The addressing bounds algorithm is a simple limit check whose formal notation is: 


case VAddr<31:30> 
set 
[0]: !'PO region 
if ZEXT( VAddr<29:9> ) GEQU POLR 
then {length violation}; 
[1]: !Pl region 
if ZEXT( VAddr<29:9> ) LSSU P1LR 
then {length violation}; 
[2]: !S region 
if ZEXT( VAddr<29:9> ) GEQU SLR 
then {length violation}; 
[3]: !reserved region 
{length violation}; 
tes; 


5.5.4 Access Control Violation Fault 


An access control fault occurs if an illegal access is attempted, as determined by the current PSL mode 
and the page’s protection field, or if the address causes a length violation. 


5.5.5 Access Across A Page Boundary 


If an access is made across a page boundary, the order in which the pages are accessed is UNPREDICTABLE. 
However, for a given page, access control violation always takes precedence over translation not valid. 


5.6 SYSTEM SPACE ADDRESS TRANSLATION 


A virtual address with <31:30>=2 is an address in the system virtual address space. 
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2 Byte 
< System Virtual Page No. (SVPN) > 


Figure 5-6 
System Virtual Page Format 


The system virtual address space is defined by the System Page Table (SPT), which is a vector of Page 
Table Entries (PTEs). The SPT is always located in physical address space. The base address of the SPT 
is also a physical address and is contained in the System Base Register (SBR). The size of the SPT in 
longwords (that is, the number of PTEs) is contained in the System Length Register (SLR). The SBR points 
to the first PTE in the SPT. In turn, this PTE maps the first page of System Space, that is, virtual byte 
address 80000000(hex). 


The PTEs in the System Page Table contain the mapping information themselves, or point to the mapping 
information in the Global Page Table if the PTE is in GPTX format. (See the section on PTEs for I/O 
devices for a description of the GPTX format.) 


33 2 
109 210 
oe 
Figure 5-7 
System Base Register (SBR) 
( to read: MFPR #12, dst.wl ) 
( to write: MTPR src.rl, #12 ) 
3 22 
1 21 0 
ee ee 


Figure 5-8 

System Length Register (SLR) 
( to read: MFPR #13, dst.wl ) 
( to write: MTPR sre.rl, #13 ) 


Bits <31:9> of the virtual address contain the Virtual Page Number. However, system virtual addresses have 
VAddr<31:30> =2. Thus, there could be as many as 2**21 pages in the system region. The length field in 
the System Length Register requires 22 bits to express the values O through 2**21 inclusive. At processor 
initialization time, the contents of both registers are UNPREDICTABLE. Figure 5-9 illustrates the translation 
of a system virtual address to a physical address. 


MEMORY MANAGEMENT Page 5-14 
System Space Address Translation 


33 2 
109 9 8 e) 
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(System Virtual 
Address) Extract and 
Check Length 
Add 
SBR: Phys Base Adr of SPT fo 
Yields 
Phys Adr of PTE 0 
Fetch 
PTE: 


Figure 5-9 
System Virtual to Physical Translation 


The algorithm to generate a physical address from a system region virtual address is: 


SYS_PA = (SBR+4*SVA<29:9>)<20:0>’SVA<8:0> !System Region 


Note 


For all occurrences within this chapter, the parentheses indicate "contents of," the angle brackets 
indicate referenced bits, and the apostrophe indicates concatenation. 
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5.7 PROCESS SPACE ADDRESS TRANSLATION 


The process virtual address space is divided into two equal sized, separately mapped regions. If virtual 
address bit 30 is 0, the address is in region PO. If virtual address bit 30 is a 1, the address is in region 
P1. 


The PO region maps a virtually contiguous area that begins at the smallest address (0) in the process virtual 
space and grows in the direction of larger addresses. PO is typically used for program images and can 
grow dynamically. 


The P1 region maps a virtually contiguous area that begins at the largest address (2**31 - 1) in the process 
virtual space and grows in the direction of smaller addresses. P1 is typically used for system-maintained, 
per-process context. It may grow dynamically for the user stack. 


Each region is described by a virtually contiguous vector of Page Table Entries. Unlike the System Page 
Table, which is addressed with a physical address, these two page tables are addressed with virtual addresses 
in the system region of the virtual address space. Thus, for per-Process Space, the address of the PTE is 
a virtual address in System Space and the fetch of the PTE is simply a longword fetch using a system 
virtual address. 


There is a significant reason to address process page tables in virtual rather than physical space. A physically 
addressed process page table that required more than a page of PTEs (that is, that mapped more than 
64K bytes of process virtual space) would require physically contiguous pages. Such a requirement would 
make dynamic allocation of process page table space very awkward since a running system tends to fragment 
storage into page-sized areas. 


A process space address translation that causes a translation buffer miss will cause one memory reference 
for the process PTE. If the virtual address of the page containing the process PTE is also missing from 
the translation buffer, a second memory reference is required. 


When a process Page Table Entry is fetched, a reference is made to System Space. This reference is 
made as a kernel read. Thus the system page containing a process page table is either "No Access" (that 
is, protection code zero) or will be accessible (protection code non-zero). Similarly, a check is made against 
the System page table Length Register (SLR). Thus, the fetch of an entry from a process page table can 
result in access or length violation faults (see the section on Faults and Parameters). 


5.7.1 PO Region 


The PO region of the address space is mapped by the PO Page Table (POPT) which is defined by the PO 
Base Register (POBR) and the PO Length Register (POLR). The POBR contains a virtual address in the 
system region which is the base address of the PO Page Table. Figure 5-10 illustrates the PO Base Register. 
The POLR contains the size of the POPT in longwords, that is, the number of Page Table Entries. Figure 
5-11 illustrates the PO Length Register. The Page Table Entry addressed by the PO Base Register maps 
the first page of the PO region of the virtual address space, that is, virtual byte address 0. 


The PTEs in the PO Page Table contain the mapping information themselves, or point to the mapping 
information in the Global Page Table if the PTE is in GPTX format. (See the section on PTEs for I/O 
devices for a description of the GPTX format.) 
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Figure 5-10 
PO Base Register (POBR) 
( to read: MFPR #8, dst.wl ) 
( to write: MTPR src.rl, #8 ) 
3 22 222 2 
1 76 4321 0 


| mez | ten |upz Length of POPT in longwords 


Figure 5-11 

PO Length Register (POLR) 

( to read: MFPR #9, dst.wl ) 
( to write: MTPR src.rl, #9 ) 


The Virtual Page Number is contained in bits <29:9> of the virtual address. A 22-bit length field is required 
to express the values 0 through 2**21 inclusive. There could be as many as 2**21 pages in the PO region. 


POLR<26:24> are ignored on MTPR and read back 0 on MFPR. At processor initialization time, the contents 
of both registers are UNPREDICTABLE. An attempt to load POBR with a value less than 2**31 or greater 
than 2**31 + 2**30 - 4 results in a reserved operand fault in some implementations. Figure 5-12 illustrates 


the PO virtual address to physical address translation. 
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Figure 5-12 
PO Virtual to Physical Translation 


The algorithm to generate a physical address from a PO region virtual address is: 


PVA_PTE = POBR+4*PVA<29:9> !PO Region PTE_PA = 
(SBR + 4*PVA_PTE<29:9>)<20:0>’PVA_PTE<8:0> PROC_PA = (PTE_PA)<20:0>’PVA<8:0> 
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5.7.2 P1 Region 


The P1 region of the address space is mapped by the P1 Page Table (P1PT) which is defined by the P1 
Base Register (P1BR) and the Pi Length Register (P1LR). Because P1 space grows towards smaller 
addresses, and because a consistent hardware interpretation of the base and length registers is desirable, 
P1BR and P1LR describe the portion of P1 space that is NOT accessible. Figure 5-13 illustrates the P1 
Base Register. Figure 5-14 illustrates the P1 Length Register. Note that P1LR contains the number of 
nonexistent PTEs. P1BR contains a virtual address of what would be the PTE for the first page of P1, that 
is, virtual byte address 40000000(hex). 


The address in P1BR is not necessarily an address in System Space, but all the addresses of PTEs must 
be in System Space. 


The PTEs in the P1 Page Table contain the mapping information, or point to the mapping information in 
the Global Page Table if the PTE is in GPTX format. (See the section on PTEs for I/O devices for a 
description of the GPTX format.) 


3 
1 210 
Figure 5-13 
P1 Base Register (P1BR) 
( to read: MFPR #10, dst.wl ) 
( to write: MTPR src.rl, #10 ) 
3 3 2 2 
10 21 0 
[toe [treat engin of PaPt in tmp 


Figure 5-14 

P1 Length Register (P1LR) 

( to read: MFPR #11, dst.wl ) 
( to write: MTPR sre.rl, #11 ) 


P1ILR<31> is ignored on MTPR and reads back 0 on MFPR. At processor initialization time, the contents 
of both registers are UNPREDICTABLE. An attempt to load P1BR with a value less than 2**31 - 2**23 
(7F800000, hex) or greater than 2**31 + 2**30 - 2**23 - 4 results in a reserved operand fault in some 
implementations. Figure 5-15 illustrates the P1 virtual address to physical address translation. 
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Figure 5-15 
P1 Virtual to Physical Translation 


The algorithm to generate a physical address from a P1 region virtual address is: 


PVA_PTE = P1iBR+4*PVA<29:9> !P1 Region PTE_PA = 
(SBR + 4*PVA_PTE<29:9>)<20:0>’PVA_PTE<8:0> PROC_PA = (PTE_PA)<20:0>’PVA<8:0> 
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5.8 TRANSLATION BUFFER 


In order to save actual memory references when repeatedly referencing the same pages, a hardware 
implementation may include a mechanism to remember successful virtual address translations and page 
states. Such a mechanism is termed a translation buffer. 


When the process context is loaded with LDPCTX, the translation buffer is automatically updated (that is, 
the process virtual address translations are invalidated). However, when the software changes any part of 
a valid Page Table Entry for the system or a current process region, it must also move a virtual address 
within the corresponding page to the Translation Buffer Invalidate Single (TBIS) register with the MTPR 
instruction. Figure 5-16 illustrates the TBIS register. 


NOTE 


\Some microVAX implementations may invalidate the entire translation buffer on a LDPCTX or a MTPR to 
TBIS.\ 


Additionally, when the software changes a System Page Table Entry which maps any part of the current 
process page table, all process pages so mapped must be invalidated in the translation buffer. They may 
be invalidated by moving an address within each such page into the TBIS register. They may also be 
invalidated by clearing the entire translation buffer. This is done by moving 0 to the Translation Buffer 
Invalidate All (TBIA) register with the MTPR instruction. Figure 5-17 illustrates the TBIA register. 


The translation buffer must not store invalid PTEs. Therefore, the software is not required to invalidate 
translation buffer entries when making changes for PTEs that are already invalid. 


When the location or size of the system map is changed (SBR, SLR) the entire translation buffer must be 
cleared by moving 0 to the Translation Buffer invalidate All (TBIA) register with the MTPR instruction. 


Whenever Memory Management Enable (MME) is a 0, the contents of the translation buffer are 
UNPREDICTABLE. Therefore, before enabling memory management at processor initialization time, or any 
other time, the entire translation buffer must be cleared by software. 


3 
1 0) 


Virtual Address 


Figure 5-16 Translation Buffer Invalidate Single (TBIS) 
( to write: MTPR srce.rl, #58 ) 
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Figure 5-17 
Translation Buffer Invalidate All (TBIA) 
( to write: MTPR src.rl, #57 ) 


An internal processor register is available for interrogating the presence of a valid translation in the translation 
buffer. When a virtual address is written to the TBCHK register with a MTPR instruction, the condition code 
V bit is set if the translation buffer holds a valid translation for that virtual page. The specification of the 
TBCHK register is based on VAX/VMS usage and is subject to change without prior notice. 


5.9 FAULTS AND PARAMETERS 


Two types of faults are associated with memory mapping and protection (see the chapter on Exceptions 
and Interrupts for a description of faults). A Translation Not Valid Fault is taken when a read or write 
reference is attempted through an invalid PTE (PTE<31>=0). An Access Control Violation Fault is taken 
when the protection field of the PTE indicates that the intended page reference in the specified access 
mode would be illegal. Note that these two faults have distinct vectors in the System Control Block. If both 
faults could occur, then the Access Control Violation Fault takes precedence. An Access Control Violation 
Fault is also taken if the virtual address referenced is beyond the end of the associated page table. Such 
a "length violation" is essentially the same as referencing a PTE that specifies "No Access" in its protection 
field. To avoid having the fault software recompute the length check, a "length violation" indication is stored 
in the fault parameter word illustrated in Figure 5-18. 


some virtual address in the faulting page 
PC of faulting instruction 
PSL at time of fault 


Figure 5-18 
Fault Parameter Block 


The same parameters are stored for both types of fault. The first parameter pushed on the stack after the 
PSL and PC is some virtual address in the same page with the virtual address that caused the fault. A 
Process Space reference can result in a System Space virtual reference for the PTE. If the PTE reference 
faults, the virtual address that is saved is the process virtual address. In addition, a 1 is stored in bit 1 of 
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the fault parameter word if the fault occurred in the per-process PTE reference. 
The second parameter pushed on the Kernel stack contains the following information: 
L <0> Length Violation. Set to 1 to indicate that an Access Control Violation 
was the result of a length violation rather than a protection violation. 
This bit is always 0 for a Translation Not Valid Fault. 
P <1> PTE Reference - Set to 1 to indicate that the fault occurred during the 
reference to the process page table associated with the virtual address. 
This can be set on either length or protection faults. 
M <2> Write or Modify Intent - Set to 1 to indicate that the program’s intended 


access was a write or modify. This bit is 0 if the program’s intended 
access was a read. 


5.10 PRIVILEGED SERVICES AND ARGUMENT VALIDATION 


5.10.1 Changing Access Modes 


Four instructions allow a program to change its access mode to a more privileged mode and transfer control 
to a service dispatcher for the new mode. 


CHMK change mode to Kernel 
CHME change mode to Exec 
CHMS change mode to Super 
CHMU change mode to User 


These instructions, described in detail in the chapter on Exceptions and Interrupts, provide the normal 
mechanism for less privileged code to call more privileged code. When the mode transition takes place, 
the previous mode is saved in the Previous Mode field of the PSL, thus allowing the more privileged code 
to determine the privilege of its caller. 


5.10.2 Validating Address Arguments (PROBE instructions) 


Two instructions, PROBER and PROBEW,, allow privileged services to check addresses passed as parameters. 
To avoid protection holes in the system, a service routine must always verify that its less privileged caller 
could have directly referenced the addresses passed as parameters (see the appendix on Address Validation 
Rules). The PROBE instructions do this verification. 
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PROBEX PROBE ACCESSIBILITY 
Purpose: 

verify that arguments can be accessed 
Format: 

opcode mode.rb, len.rw, base.ab 
Operation: 


probe mode <- MAXU (mode<1:0>, PSL<PRV_MOD>) 

condition codes <- {accessibility of base} and 
{accessibility of {base+ZEXT(len)-1}} 
using probe mode 


Condition Codes: 


N <- 0; 
Z<- if {both accessible} then 0 else 1; 
V <- 0; 
C.'s= Gs 
Exceptions: 
translation not valid 
Opcodes: 


OC PROBER Probe Read Accessibility 
OD PROBEW Probe Write Accessibility 


Description: 


The PROBE instruction checks the read or write accessibility of the first and last byte specified by the base 
address and the zero extended length. Note that the bytes in between are not checked. System software 
must check all pages between the two end bytes if they will be accessed. 


The protection is checked against the larger (and therefore less privileged) of the modes specified in bits 
<1:0> of the mode operand and the Previous Mode field of the PSL. Note that probing with a mode operand 
of 0 is equivalent to probing the mode specified in PSL<previous-mode>. 


Example: 


MOVL 4(AP),RO sCopy the address of first arg so that 
> 1t can't be changed. 
PROBER #0,#4, (RO) ;Verify that the longword pointed to by 


; the first arg could be read by the 
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BEQL violation 
MOVQ 8(AP),RO 


PROBEW #0,R0,(R1) 


BEQL violation 


Flows: 


previous access mode. 
Note that the arg list itself must 
already have been probed 
Branch if either byte gives an access 
violation. 
Copy length and address of buffer args 
* so that they can't change. 
sVerify that the buffer described by the 
- 2nd and 3rd args could be written by 
; the previous access mode. 
sNote that the arg list must already 


se =e 6 SO WO 


have been probed and that the 2nd arg 

must be known to be less than 512. 
Branch if either byte gives an access 
violation. 


The following flows describe the operation of PROBE on each of the virtual addresses it is checking. Note 
that probing an address returns only the accessibility of the page(s) and has no effect on their residency. 
However, probing a process address may cause a page fault in the system address space on the per-process 


page tables. 

e Look up the virtual address in the translation buffer. If found, use the associated protection 
field to determine the accessibility and EXIT. 

° Check for length violation for System or per-Process address as appropriate. See elsewhere 
in this chapter for the length violation check flows. If length violation then return No Access 
and EXIT. 

e If System virtual address, form physical address of PTE, fetch the PTE, use the protection 
field to determine the accessibility and EXIT. 

e For per-Process virtual address, must do a virtual memory reference for the PTE. 


Te Look up the virtual address of the PTE in the translation buffer, form the physical address 
of the PTE if found, fetch the PTE, use the protection field to determine the accessibility 


and EXIT. 


2. Check the System virtual address of the PTE for length violation. If length violation, then 


return No Access and EXIT. 


3. T1 <- Page Table Entry for the page containing the per-process PTE. 


4, If the protection field of T1 indicates no access (not even readable by Kernel), then 
return No Access and EXIT. A no access, not valid pointer to a page of PTE’s conserves 
storage space for a page full of no access, not valid PTE’s. 


oS: If the valid bit in T1 is 0, then take a Translation Not Valid Fault and EXIT. This case 
allows for the demand paging of per-process page tables. 
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6. Finally, calculate the physical address of the per-process PTE from the PFN field of T1 
(see the section on System Space Address Translation), fetch the PTE, use the protection 
field to determine the accessibility, and EXIT. 


5.10.3 Notes On The PROBE instructions 


° If the Valid bit of the examined Page Table Entry is set, it is UNPREDICTABLE whether the 
Modify bit of the examined Page Table Entry is set by a PROBEW. If the Valid bit is clear, 
the Modify bit is not changed. 


e Except for 1, above, the valid bit of the Page Table Entry, PTE<31>, mapping the probed 
address is ignored. 


e A length violation gives a status of "not-accessible." 

e On the probe of a process virtual address, if the valid bit of the system Page Table Entry is 
0 then a Translation Not Valid Fault occurs. This allows for the demand paging of the process 
page tables. 

e On the probe of a process virtual address, if the protection field of the system Page Table 


Entry indicates No Access, then a status of "not-accessible" is given. Thus, a single No Access 
Page Table Entry in the system map is equivalent to 128 No Access Page Table Entries in 
the process map. 


[End of Chapter 5] 
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CHAPTER 6 


EXCEPTIONS AND INTERRUPTS 


6.1 INTRODUCTION 


At certain times during the operation of a system, events within the system require the execution of particular 
pieces of software outside the explicit flow of control. The processor transfers control by forcing a change 
in the flow of control from that explicitly indicated in the currently executing process. 


Some of the events are relevant primarily to the currently executing process, and normally invoke software 
in the context of the current process. The notification of such events is termed an exception. 


Other events are primarily relevant to other processes, or to the system as a whole, and are therefore 
serviced in a system-wide context. The notification process for these events is termed an interrupt, and the 
system-wide context is described as "executing on the interrupt stack" (IS). Further, some interrupts are of 
such urgency that they require high-priority service, while others must be synchronized with independent 
events. To meet these needs, the processor has priority logic that grants interrupt service to the highest 
priority event at any point in time. The priority associated with an interrupt is termed its interrupt priority 
level (IPL). 


6.1.1 Processor Interrupt Priority Levels (IPL) 


The processor has 31 interrupt priority levels (IPL), divided into 15 software levels (numbered, in hex, 01 
to OF), and 16 hardware levels (10 to 1F, hex). User applications, system calls, and system services all run 
at process level, which may be thought of as IPL 0. Higher numbered interrupt levels have higher priority, 
that is to say, any requests at an interrupt level higher than the processor’s current IPL will interrupt 
immediately but requests at a lower or equal level are deferred. 


Interrupt levels 01 through OF (hex) exist entirely for use by software. No device can request interrupts on 
those levels, but software can force an interrupt by executing MTPR src,#SIRR. (See Chapter 9 and section 
on software generated interrupts later in this chapter). Once a software interrupt request is made, it will be 
cleared by the hardware when the interrupt is taken. 


Interrupt levels 10 to 17 (hex) are for use by devices and controllers, including UNIBUS devices; UNIBUS 
levels BR4 to BR7 correspond to VAX interrupt levels 14 to 17 (hex). 


Interrupt levels 18 to 1F (hex) are for use by urgent conditions, serious errors, and power fail. 
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6.1.2 Interrupts 


The processor arbitrates interrupt requests according to priority. Only when the priority of an interrupt request 
is higher than the current IPL (Bits 20:16 of the Processor Status Longword) will the processor raise the 
IPL and service the interrupt request. The interrupt service routine is entered at the IPL of the interrupt 
request and will not usually change the IPL set by the processor. Note that this is different from the PDP-11 
where the interrupt vector specifies the IPL for the ISR. 


Interrupt requests can come from devices, controllers, other processors, or the processor itself. Software 
executing in kernel mode can raise and lower the priority of the processor by executing MTPR src, #IPL 
where src contains the new priority desired; see Chapter 9. However, a processor cannot disable interrupts 
on other processors. Furthermore the priority level of one processor does not affect the priority level of the 
other processors. Thus in multiprocessor systems interrupt priority levels cannot be used to synchronize 
access to shared resources. Even the various urgent interrupts including those exceptions that run at IPL 
1F (hex) do so on only one processor, thus special software action is required to stop other processors in 
a multiprocessor system. 


6.1.3 Exceptions 


Most exception service routines execute at IPL 0 in response to exception conditions caused by the software. 
A variation from this is serious system failures, which raise IPL to the highest level (1F, hex) to minimize 
processor interruption until the problem is corrected. Exception service routines are usually coded to avoid 
exceptions, however nested exceptions can occur. 


A trap is an exception condition that occurs at the end of the instruction that caused the exception. Therefore 
the PC saved on the stack is the address of the next instruction that would normally have been executed. 
Any software can enable and disable some of the trap conditions with a single instruction; see the BISPSW 
and BICPSW instructions described in Chapter 4. 


A fault is an exception condition that occurs during an instruction, and that leaves the registers and memory 
in a consistent state such that elimination of the fault condition and restarting the instruction will give correct 
results. Note that faults do not always leave everything as it was prior to the faulted instruction, they only 
restore enough to allow restarting. Thus, the state of a process that faults may not be the same as that of 
a process that was interrupted at the same point. 


An abort is an exception condition that occurs during an instruction, leaving the value of registers and 
memory UNPREDICTABLE, such that the instruction cannot necessarily be correctly restarted, completed, 
simulated, or undone. After an instruction aborts, PC addresses the opcode of the aborted instruction. The 
following are UNPREDICTABLE: 


e destination operands (including implied operands, such as the top of the stack in an JSB 
instruction) 


e registers modified by operand specifier evaluation (including specifiers for implied operands) 


e the PTE<M> bit in PTEs that map destination operands, if the operands could have been 
written but were not written, and PTE<M> was clear before the instruction 
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condition codes 


PSL<FPD> 


PSL<TP> 


Except where otherwise noted in the description of the abort, the rest of the PSL, other registers, and 
memory are unaffected. 


6.1.4 Contrast Between Exceptions And Interrupts 


Generally exceptions and interrupts are very similar. When either is initiated, both the processor status (PSL) 
and the program counter (PC) are pushed onto the stack. However there are seven important differences: 


An exception condition is caused by the execution of the current instruction while an interrupt 
is caused by some activity in the computing system that may be independent of the current 
instruction. 


An exception condition is usually serviced in the context of the process that produced the 
exception condition, while an interrupt is serviced independently from the currently running 
process. 


The IPL of the processor is usually not changed when the processor initiates an exception, 
while the IPL is always raised when an interrupt is initiated. 


Exception service routines usually execute on a per-process stack while interrupt service routines 
normally execute on a per-CPU stack. 


Enabled exceptions are always initiated immediately no matter what the processor IPL is, while 
interrupts are held off until the processor IPL drops below the IPL of the requesting interrupt. 


Most exceptions can not be disabled. However, if an exception causing event occurs while 
that exception is disabled, no exception is initiated for that event even when enabled 
subsequently. This includes overflow which is the only exception whose occurrence is indicated 
by a condition code (V). If an interrupt condition occurs while it is disabled, or the processor 
is at the same or higher IPL, the condition will eventually initiate an interrupt when the proper 
enabling conditions are met if the condition is still present. 


The previous mode field in the PSL is always set to Kernel on an interrupt, but on an exception 
it indicates the mode of the exception. 


6.2 PROCESSOR STATUS 


When an exception or an interrupt is serviced, the processor status must be preserved so that the interrupted 
process may continue normally. Basically, this is done by automatically saving the Program Counter (PC) 
and the Processor Status Longword (PSL). These are later restored with the Return from Exception or 
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Interrupt instruction (REI). Any other status required to correctly resume an interruptable instruction is stored 
in the general registers. Process context such as the mapping information is not saved or restored on each 
interrupt or exception. Instead, it is saved and restored only when process context switching is performed. 
Refer to the LDPCTX and SVPCTX instructions in chapter 7. Other processor status is changed even less 
frequently; refer to the privileged register descriptions in chapter 9. 


The Processor Status Longword (PSL) is a longword consisting of a word of privileged processor status 
concatenated with the Processor Status Word (PSW). Refer to chapter 2 for a description of the PSL. The 
PSL is automatically saved on the stack when an exception or interrupt occurs and is saved in the PCB 


on a process context switch. (The terms current PSL and saved PSL are used to distinguish between this 
status information when it is in the processor and when copies of it are materialized in memory.) 


6.3 INTERRUPTS 
The processor services interrupt requests between instructions. The processor also services interrupt requests 
at well defined points during the execution of long, iterative instructions such as the string instructions. For 
these instructions, in order to avoid saving additional instruction state in memory, interrupts are initiated 
when the instruction state can be completely contained in the registers, PSL, and PC. 
The following events cause interrupts: 

e Device completion (IPL 10-17 hex) 

° Device error (IPL 10-17 hex) 


e Device alert (IPL 10-17 hex) 


e Device memory error (IPL 10-17 hex) 

° Console terminal transmit and receive (IPL 14 hex) 

e Interval timer (implementation specific, IPL 16 or 18 hex) 

e Recovered memory or bus or processor errors (implementation specific, IPL 18 to 1D hex); 


the VAX-11/780 processor interrupts at 1B on memory errors. 
e Unrecovered memory or bus or processor errors (implementation specific, IPL 18 to 1D hex) 
° Power fail (IPL 1E hex) 
e Software interrupt invoked by MTPR #SIRR (IPL 01 to OF hex) 


e AST delivery when REI restores a PSL with mode greater than or equal to ASTLVL (see 
chapter 7) (IPL 02) 


Each device controller has a separate set of interrupt vector locations in the system control block (SCB). 
Thus interrupt service routines do not need to poll controllers in order to determine which controller interrupted. 
The vector address for each controller is fixed by hardware. 
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In order to reduce interrupt overhead, no memory mapping information is changed when an interrupt occurs. 
Thus the instructions, data, and contents of the interrupt vector for an interrupt service routine must be in 
the system address space or present in every process at the same address. 


6.3.1 Urgent Interrupts -- Levels 18-1F (Hex) 


The processor provides 8 priority levels for use by urgent conditions including serious errors (e.g., machine 
check) and power fail. Some implementations may not use all 8 priority levels. Interrupts on these levels 
are initiated by the processor upon detection of certain conditions. Some of these conditions are not interrupts. 
For example, Machine Check is usually an exception but it runs at a high priority level on the interrupt 
stack. 


Interrupt level 1& (hex) is reserved for power fail. Interrupt level 1F (hex) is reserved for those exceptions 
that must lock out all processing until handled. This includes the hardware and software "disasters" (machine 
check and kernel stack not valid). It might also be used to allow a kernel mode debugger to gain control 
on any exception. 


6.3.2 Device Interrupts -- Levels 10-17 (Hex) 


The processor provides 8 priority levels for use by peripheral devices. Any given implementation may or 
may not implement all 8 levels of interrupts. The minimal implementation is levels 14-17 (hex) that correspond 
to the UNIBUS levels BR4 to BR7 if the system has a UNIBUS. 


6.3.3 Software Generated Interrupts -- Levels 01-0F (Hex) 


6.3.3.1 Software Interrupt Summary Register - The processor provides 15 priority interrupt levels for use 
by software. Pending software interrupts are recorded in the Software Interrupt Summary Register (SISR). 
The SISR contains 1’s in the bit positions corresponding to levels on which software interrupts are pending. 
All such levels, of course, must be lower than the current processor IPL, or the processor would have taken 
the requested interrupt. 


Pending Software Interrupts 


FEDCBA98 7654321 


Software Interrupt Summary Register 


The SISR is a read/write privileged register accessible only to privileged software (see Chapter 9). At 
bootstrap time, the contents of SISR is cleared. The mechanism for accessing it is: 
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MFPR SISR,dst Reads the software interrupt Summary register. 
MTPR src, SISR Loads it, but this is not the normal way of making software interrupt requests. It is 


useful for clearing the software interrupt system, and for reloading its state after a 
power fail, for example. 


6.3.3.2 Software Interrupt Request Register - The software interrupt request register (SIRR) is a write-only 
four bit privileged register used for making software interrupt requests. 


3 
1 43 ) 


Software Interrupt Request Register 


Executing MTPR src,#SIRR requests an interrupt at the level specified by src<3:0>. Once a software interrupt 
request is made, it will be cleared by the hardware when the interrupt is taken. If src<3:0> is greater than 
the current IPL, the interrupt occurs before execution of the following instruction. If src<3:0> is less than 
or equal to the current IPL, the interrupt will be deferred until the IPL is lowered to less than src<3:0> and 
that there is no higher interrupt level pending. This lowering of IPL is by either RE! or by MTPR x,#IPL. 
If src<3:0> is 0, no interrupt will occur. 


Note that no indication is given if there is already a request at the selected level. Therefore, the service 
routine must not assume that there is a one-to-one correspondence of interrupts generated and requests 
made. A valid protocol for generating such a correspondence is: 


° The requester uses INSQUE to place a control block describing the request onto a queue for 
the service routine. 


e The requester uses MTPR src,#SIRR to request an interrupt at the appropriate level. 


° The service routine uses REMQUE to remove a control block from the queue of service 
requests. If REMQUE returns failure (nothing in the queue), the service routine exits with REI. 


e If REMQUE returns success (an item was removed from the queue), the service routine performs 
the service and returns to step 3 to look for other requests. 


6.3.4 Interrupt Priority Level Register 


Writing to the IPL with the MTPR instruction will load the processor priority field in the Program Status 
Longword (PSL), that is, PSL<20:16> is loaded from IPL<4:0>. Reading from IPL with the MFPR instruction 
will read the processor priority field from the PSL. On writing IPL bits <31:5> are ignored, on reading IPL 
bits <31:5> are returned zero. 
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Interrupt Priority Level Register 


At bootstrap time, IPL is initialized to 31 (1F, hex). 


Interrupt service routines must follow the discipline of not lowering IPL below their initial level. If they do, 
an interrupt at an intermediate level could cause the stack nesting to be improper. This would result in REI 
faulting. Actually, a service routine could lower the IPL if it ensures that no intermediate levels could 


interrupt, however this is probably unreliable code. 
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6.3.5 Interrupt Example 
As an example, assume the processor is running in response to an interrupt at IPL5, it then sets IPL to 


8, and then posts software requests at IPL3, IPL7, and IPL9. Then a device interrupt arrives at IPL14 (hex). 
Finally IPL is set back to IPL5. The sequence of execution is: 


state after event IPL in 
event contents of IPL SISR PSL on 
(hex) (hex) stack 
(initial) 5 0 0 
MTPR #8,#IPL 8 0 0 
MTPR #3,#SIRR 8 8 0 
MTPR #7,#SIRR 8 88 0 
MTPR #9,#SIRR interrupts to 9 88 8,0 
device interrupts to 14 88 9,8,0 
device service routine REI 9 88 8,0 
IPLY service routine REI 8 88 ) 


MTPR #5,#IPL changes IPL to 5 
and the request for 7 is 
granted immediately 7 8 5,0 


IPL7 service routine REI 5 8 0 
initial IPL5 service routine 

REI back to IPLO and the 

request for 3 1s granted 

immediately 3 0 0 
IPL3 service routine REI 0 0 —— 


6.4 EXCEPTIONS 


Exceptions can be grouped into six classes: 


e Arithmetic traps/faults 

e Memory management exceptions 

e Exceptions detected during operand reference 

e Exceptions occuring as a consequence of an instruction 
e Tracing 


e Serious system failures 
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6.4.1 Arithmetic Traps/Faults 


This section contains the descriptions of the exceptions that occur as the result of performing an arithmetic 
or conversion operation. They are mutually exclusive and all are assigned the same vector in the SCB, and 
hence the same signal "reason" code. Each of them indicates that an exception had occurred during the 
last instruction and that the instruction has been completed (trap) or backed up (fault), An appropriate 
distinguishing code is pushed on the stack as a longword: 


PSL 
*same as the instruction causing exception in case of fault 
type code exception type software mnemonic 

(hex) 

TRAPS 
1 integer overflow SRMSK_INT OVF T 
2 integer divide by zero SRMSK_ INT DIV T 
3 floating overflow SRMSK FLT OVF T 
4 floating/decimal divide by zero SRM$K_ FLT DIV T 
5 floating underflow SRMSK_ FLT UND T 
6 decimal overflow SRMSK DEC OVF T 
7 subscript range SRMSK_SUB RNG T 

FAULTS 
8 floating overflow SRMSK_ FLT OVF F 
9 floating divide by zero SRMSK FLT DIV F 
A floating underflow SRMSK FLT UND F 


6.4.1.1 Integer Overflow Trap - An integer overflow trap is an exception that indicates that the last instruction 
executed had an integer overflow setting the V condition code and that integer overflow was enabled (IV 
set). The result stored is the low-order part of the correct result. N and Z are set according to the stored 
result. The type code pushed on the stack is 1 (SRM$K_INT_OVF_T). 


6.4.1.2 Integer Divide By Zero Trap - An integer divide by zero trap is an exception that indicates that 
the last instruction executed had an integer zero divisor. The result stored is equal to the dividend and 
condition code V is set. The type code pushed on the stack is 2 (SRM$K_INT_DIV_T). 
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6.4.1.3 Floating Overflow Trap - A floating overflow trap is an exception that indicates that the last instruction 
executed resulted in an exponent greater than the largest representable exponent for the data type after 
normalization and rounding. The result stored contains a one in the sign and zeros in the exponent and 
fraction fields. This is a reserved operand, and will cause a reserved operand fault if used in a subsequent 
floating point instruction. The N and V condition code bits are set and Z and C are cleared. The type code 
pushed on the stack is 3 (SRM$K_FLT_OVF_T). 


6.4.1.4 Divide By Zero Trap - Floating or Decimal String - A floating divide by zero trap is an exception 
that indicates that the last instruction executed had a floating zero divisor. The result stored is the reserved 
operand, as described above for floating overflow trap, and the condition codes are set as in floating 
overflow. 


A decimal string divide by zero trap is an exception that indicates that the last instruction executed had a 
decimal string zero divisor. The destination, RO through R5, and condition codes are UNPREDICTABLE. 
The zero divisor can be either +0 or -0. 


The type code pushed on the stack for both types of divide by zero is 4 (SRM$K_FLT_DIV_T). 


6.4.1.5 Floating Underflow Trap - A floating underflow trap is an exception that indicates that the last 
instruction executed resulted in an exponent less than the smallest representable exponent for the data type 
after normalization and rounding and that floating underflow was enabled (FU set). The result stored is zero. 
Except for POLYx the N, V, and C condition codes are cleared and Z is set. In POLYx, the trap occurs 
on completion of the instruction, which may be many operations after the underflow. The condition codes 
are set on the final result in POLYx. The type code pushed on the stack is 5 (GRM K_FLT_UND_1T). 


6.4.1.6 Decimal String Overflow Trap - A decimal string overflow trap is an exception that indicates that 
the last instruction executed had a decimal string result too large for the destination string provided and 
that decimal overflow was enabled (DV set). The V condition code is always set. Refer to the individual 
instruction descriptions in Chapter 4 for the value of the result and of the condition codes. The type code 
pushed on the stack is 6 (GRM$K_DEC_OVF_1T). 


6.4.1.7 Subscript Range Trap - A subscript range trap is an exception that indicates that the last instruction 
was an INDEX instruction with a subscript operand that failed the range check. The value of the subscript 
operand is lower than the low operand or greater than the high operand. The result is stored in indexout, 
and the condition codes are set as if the subscript were within range. The type code pushed on the stack 
is 7 (SRM$K_SUB_RNG_T). 


6.4.1.8 Floating Overflow Fault - A floating overflow fault is an exception that indicates that the last 
instruction executed resulted in an exponent greater than the largest representable exponent for the data 
type after normalization and rounding. The destination was unaffected and the saved condition codes are 
UNPREDICTABLE. The saved PC points to the instruction causing the fault. In the case of a POLY instruction, 
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the instruction is suspended with FPD set (see Chapter 4 for details). The type code pushed on the stack 
is 8 (SRM$K_FLT_OVF_F). 


6.4.1.9 Divide By Zero Floating Fault - A floating divide by zero fault is an exception that indicates that 
the last instruction executed had a floating zero divisor. The quotient operand was unaffected and the saved 
condition codes are UNPREDICTABLE. The saved PC points to the instruction causing the fault. The type 
code pushed on the stack is 9 (SRM$K_FLT_DIV_F). 


6.4.1.10 Floating Underflow Fault - A floating underflow fault is an exception that indicates that the last 
instruction executed resulted in an exponent less than the smallest representable exponent for the data type 
after normalization and rounding and that floating underflow was enabled (FU set). The destination operand 
is unaffected. The saved condition codes are UNPREDICTABLE. The saved PC points to the instruction 
causing the fault. In the case of a POLY instruction, the instruction is suspended with FPD set (see Chapter 
4 for details). The type code pushed on the stack is 10 (SRM K_FLT_UND_F). 


6.4.2 Memory Management Exceptions 


A memory management exception can be either an access violation or a translation not valid fault. 


6.4.2.1 Access Control Violation Fault - An access control violation fault is an exception indicating that 
the process attempted a reference not allowed at the access mode at which the process was operating. 
See Chapter 5, Memory Management, for a description of the information pushed on the stack as parameters. 
Software may restart the process after changing the address translation information. 


6.4.2.2 Translation Not Valid Fault - A translation not valid fault is an exception indicating that the process 
attempted a reference to a page for which the valid bit in the page table was not set. See Chapter 5, 
Memory Management, for a description of the information pushed on the stack as parameters. Note that if 
a process attempts to reference a page for which the page table entry specifies both Not Valid and Access 
Violation, an Access Control Violation Fault occurs. 


6.4.3 Exceptions Detected During Operand Reference 


6.4.3.1 Reserved Addressing Mode Fault - A reserved addressing mode fault is an exception indicating 
that an operand specifier attempted to use an addressing mode that is not allowed in the situation in which 
it occurred. No parameters are pushed. 
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The situations in which each specifier type is reserved are: 


SPECIFIER RESERVED SITUATION 
Short Literal Modify, destination, address 
source, Or within index mode. 
Register Address source or within index mode. 
Index Mode Within index mode, or with PC as index. 


See Chapter 3 for combinations of addressing modes and registers that cause UNPREDICTABLE results. 
The VAX-11/780 processor also faults on PC, @PC, and -(PC). 


6.4.3.2 Reserved Operand Exception - A reserved operand exception is an exception indicating that an 
operand accessed has a format reserved for future use by DIGITAL. No parameters are pushed. This 
exception always backs up the PC to point to the opcode. The exception service routine may determine 
the type of operand by examining the opcode using the stored PC. Note that only the changes made by 
instruction fetch and because of operand specifier evaluation may be restored. Therefore, some instructions 
are not restartable. These exceptions are labelled as ABORTs rather than FAULTs. The PC is always restored 
properly unless the instruction attempted to modify it in a manner that results in UNPREDICTABLE results. 


The reserved operand exceptions are caused by: 
° Bit field too wide (FAULT) 
° Invalid combination of bits in PSL restored by REI (FAULT) 
e Invalid combination of bits in PSW/MASK longword during RET (FAULT) 
e Invalid combination of bits in BISPSW/BICPSW (FAULT) 
e Invalid CALLx entry mask (FAULT) 
e Invalid register number in MFPR or MTPR (FAULT) 
° Invalid combinations in PCB loaded by LDPCTX (ABORT) 
e Unaligned operand in ADAWI (FAULT) 
e Invalid register contents in MTPR instructions to some registers for some implementations 


(FAULT): 


SISR<31:16>'SISR<0> NEQU 0 
POBR<1:0> NEQU 0 

POBR LSSU 2**31 

POBR GTRU 2%**31+2**30-1 
PIBR<1:0> NEQU 0 

PIBR LSSU 2*¥*31-2**23 
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PIBR GTRU 2**31+2**30-2**23-1 
POLR<31:27>'POLR<23:22> NEQU 0 
P1ILR<30:22> NEQU 0 
ASTLVL<2:0> GTRU 4 


° Invalid operand addresses in INSQHI, INSQTI, REMQHI, or REMQTI (FAULT) 


e A floating point number that has the sign bit set and the exponent zero except in the POLY 
table (FAULT) 


e A floating point number that has the sign bit set and the exponent zero in the POLY table 
(FAULT; see chapter 4 for restartability) 


e POLY degree too large (FAULT) 

° Decimal string too long (ABORT) 

° Invalid digit in CVTTP, CVTSP (ABORT) 

° Reserved pattern operator in EDITPC (FAULT; see Chapter 4 for restartability) 


« Incorrect source string length at completion of EDITPC (ABORT) 


6.4.4 Exceptions Occurring As The Consequence Of An Instruction 


6.4.4.1 Opcode Reserved To DIGITAL Fault - An opcode reserved to DIGITAL fault occurs when the 
processor encounters an opcode that is not specifically defined, or that requires higher privileges than the 
current mode. No parameters are pushed. Opcode FFFF (hex) will always fault. 


6.4.4.2 Opcode Reserved To Customers (and CSS) Fault - An opcode reserved to customers fault is an 
exception that occurs when an opcode reserved to the customers or DIGITAL’s Computer Special Systems 
group is executed. The operation is identical to the opcode reserved to DIGITAL fault except that the event 
is caused by a different set of opcodes, and faults through a different vector. All opcodes reserved to 
customers (and CSS) start with FC (hex), which is the XFC instruction. If the special instruction needs to 
generate a unique exception, one of the reserved to CSS/Customer vectors should be used. An example 
might be an unrecognized second byte of the instruction. 


The XFC fault is intended primarily for use with writable control store to implement installation-specific 
instructions. The method used to enable/disable the handling of an XFC fault in user written microcode is 
implementation dependent. Some implementations may transfer control to microcode without checking bits 
<1:0> of the exception vector. 
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6.4.4.3 Compatibility Mode Exception - A compatibility mode exception is an exception that occurs when 
the processor is in compatibility mode. 
A longword of information is pushed on the stack, which contains a code as follows: 


0 reserved opcode FAULT 
1 BPT FAULT 
2 IOT FAULT 
3 EMT FAULT 
A TRAP FAULT 
5 illegal instruction FAULT 
6 odd address ABORT 


All other exceptions in compatibility mode occur to the regular VAX vector, e.g., Access Control Violation, 
Translation Not Valid, Memory Error, and Machine Check Abort. See chapter 10, Compatibility Mode. 


6.4.4.4 Breakpoint Fault - A breakpoint fault is an exception that occurs when the breakpoint instruction 
(BPT) is executed. No parameters are pushed. 


To proceed from a breakpoint, a debugger or tracing program typically restores the original contents of the 
location containing the BPT, sets T in the PSL saved by the BPT fault, and resumes. When the breakpointed 
instruction completes, a trace exception will occur (see section on tracing). At this point, the tracing program 
can again re-insert the BPT instruction, restore T to its original state (usually clear), and resume. Note that 
if both tracing and breakpointing are in progress (i.e., if PSL<T> was set at the time of the BPT), then on 
the trace exception both the BPT restoration and a normal trace exception should be processed by the 
trace handler. 


6.4.5 Tracing 


A trace is an exception that occurs between instructions when trace is enabled. Tracing is used for tracing 
programs, for performance evaluation, or debugging purposes. It is designed so that one and only one 
trace exception occurs before the execution of each traced instruction. The saved PC on a trace is the 
address of the next instruction that would normally be executed. If a trace fault and a memory management 
fault (or an odd address abort during a compatibility mode instruction fetch) occur simultaneously, the order 
in which the exceptions are taken is UNPREDICTABLE. The trace fault for an instruction takes precedence 
over all other exceptions. 


In order to ensure that exactly one trace occurs per instruction despite other traps and faults, the PSL 
contains two bits, trace enable (T) and trace pending (TP). If only one bit were used then the occurrence 
of an interrupt at the end of an instruction would either produce zero or two traces, depending on the 
design. Instead of the PSL<T> bit being defined to produce a trap after any other traps or aborts at the 
end of an instruction, the trap effect is implemented by copying PSL<T> to a second bit (PSL<TP>) that is 
actually used to generate the exception. PSL<TP> generates a fault before any other processing at the start 
of the next instruction. 


The rules of operation for trace are: 


e At the beginning of an instruction, if TP is set then a trace fault is taken after clearing TP. 
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° TP is loaded with the value of T. 
° If the instruction faults or an interrupt is serviced, PSL<TP> is cleared before the PSL is 


pushed. The pushed PC is set to the start of the faulting or interrupted instruction. Instruction 
execution is resumed at Step 1. 


° If the instruction aborts or takes an arithmetic trap, PSL<TP> is not changed before the PSL 
is pushed. 
° If an interrupt is serviced after instruction completion and arithmetic traps but before tracing 


is checked for at the start of the next instruction, then PSL<TP> is not changed before the 
PSL is pushed. 


The routine entered by a CHM«x is not traced because CHMx clears T and TP in the new PSL. However, 
if T was set at the beginning of CHMx the saved PSL will have both T and TP set. Trace faults resume 
with the instruction following the REI in the routine entered by the CHMx. An instruction following an REI 
will fault either if T was set when the REI was executed or if TP in the saved PSL is set; in both cases 
TP is set after the REI. Note that a trace fault that occurs for an instruction following an REI that sets TP 
will be taken with the new PSL. Thus, special care must be taken if exception or interrupt routines are 
traced. If the T bit is set by a BISPSW instruction, trace faults begin with the second instruction after the 
BISPSW. 


In addition, the CALLx instructions save a clear T, although T in the PSL is unchanged. This is done so 
that a debugger or trace program proceeding from a BPT fault does not get a spurious trace from the RET 
that matches the CALL. 


The detection of reserved instruction faults occurs after the trace fault. The detection of interrupts and other 
exceptions can occur during instruction execution. In this case, TP is cleared before the exception or 
interrupt is initiated. The entire PSL (including T and TP) is automatically saved on interrupt or exception 
initiation and is restored at the end with an REI. This makes interrupts and benign exceptions totally 
transparent to the executing program. 


6.4.5.1 Trace Instruction Summary - The following table shows all of the cases of T enabled at the 
beginning of the instruction, enabled at the end of the instruction, and TP set in the popped PSW or PSL 
for ordinary instructions (XXX), CHMx...REI, interrupt or exception...REI, CALLx, RETURN, CHMx, REI, 
BISPSW, and BICPSW: 
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Trace exception 
enabled enabled TP bit 
at beg at end at end 
(T) (T) (TP) 
XXX N N N 
bg x Y 
CHMx...REI N N N 
Y BG Y 
interrupt or N N N 
exception...REI Y Y Y 
CALLx N N N 
Y Y Y (pushed PSW<T> clear) 
RET N N* N 
N y* N (no fault before 
next instruction) 
Y N* Y 
Y Yy* Y 
CHMx N N N (pushed PSL<TP> clear) 
Y N N (pushed PSL<TP> set) 
REI N N* N 
(if PSL<TP>=0 N y* N 
on stack) Y N* Y 
Y Y* Y 
REI N N* Y 
(if PSL<TP>=1 N y* Y 
on stack) y N* Y 
Y Yy* Y 
BISPSW N Y N 
Y A Y 
BICPSW N N N 
Y N Y 
interrupt or N N N (pushed PSL<TP> clear) 
exception Y N N (pushed PSL<TP> depends 


on above description) 


* = depends on PSW<T> popped from stack 
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6.4.5.2 Using Trace - Routines using the trace facility are termed trace handlers. They should observe the 
following conventions and restrictions: 


When the trace handler performs its REI back to the traced program, it should always force 
the T bit on in the PSL that will be restored. This defends against programs clearing T via 
RET, REI, or BICPSW. 


The trace handler should never examine or alter the TP bit when continuing tracing. The 
hardware flows ensure that this bit is maintained correctly to continue tracing. 


When tracing is to be ended, both T and TP should be cleared. This ensures that no further 
traces will occur. 


Tracing a service routine that completes with an REI will give a trace in the restored mode 
after the REI. If the program being restored to was also being traced, only one trace exception 
is generated. 


lf a routine entered by a CALLx instruction is executed at full speed by turning off T, then 
trace control can be regained by setting T in the PSW in its call frame. Tracing will resume 
after the instruction following the RET. 


Tracing is disabled for routines entered by a CHMx instruction or any exception. Thus, if a 
CHMx or exception service routine is to be traced, a breakpoint instruction must be placed at 
its entry point. If such a routine is recursive, breakpointing will catch each recursion only if 
the breakpoint is not on the CHMx or instruction with the exception. 


If it is desired to allow multiple trace handlers, all handlers should preserve T when turning 
on and off trace. They also would have to simulate traced code that alters or reads T. 


6.4.6 Serious System Failures 


6.4.6.1 Kernel Stack Not Valid Abort - Kernel stack not valid abort is an exception that indicates that the 
Kernel stack was not valid while the processor was pushing information onto the Kernel stack during the 
initiation of an exception or interrupt. Usually this is an indication of a stack overflow or other executive 
software error. The attempted exception is transformed into an abort that uses the interrupt stack. No extra 
information is pushed on the interrupt stack in addition to PSL and PC. IPL is raised to 1F (hex). If the 
exception vector <1:0> is 0, the operation of the processor is UNDEFINED. Software may abort the process 
without aborting the system. However, because of the lost information, the process cannot be continued. If 
the Kernel Stack is not valid during the normal execution of an instruction (including CHMK or REl), the 
normal memory management fault is initiated. If the exception vector <1:0> for Kernel Stack Not Valid is 
3, the behavior of the processor is UNDEFINED (see section on SCB vectors). 
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6.4.6.2 Interrupt Stack Not Valid Halt - An interrupt stack not valid halt is an exception that indicates that 
the interrupt stack was not valid or that a memory error occurred while the processor was pushing information 
onto the interrupt stack during the initiation of an exception or interrupt. No further interrupt requests are 
acknowledged on this processor. The processor leaves the PC, the PSL, and the reason for the halt in 
registers so that it is available to a debugger, the normal bootstrap routine, or an optional watch dog 
bootstrap routine. A watch dog bootstrap can cause the processor to leave the halted state. 


6.4.6.3 Machine Check Exception - A machine check exception indicates that the processor detected an 
internal error in itself. As usual for exceptions, this exception is taken independent of IPL. IPL is raised to 
1F (hex) only if vector<1:0> is 1. 


Implementation specific information is pushed on the stack as longwords. The processor specifies the number 
of bytes pushed by placing the number of bytes pushed as the last longword pushed. (0 if none, 4 if one, 
...). This count excludes the PC, PSL, and count longwords. Software can decide, on the basis of the 
information presented, whether to abort the current process if the machine check came from the process. 
Machine check includes uncorrected bus and memory errors anywhere, and any other processor-detected 
errors. Some processor errors cannot ensure the state of the machine at all. For such errors, the state will 
be preserved on a "best effort" basis. If the exception vector <1:0> for machine check is 3, the behavior 
of the processor is UNDEFINED (see section on SCB vectors). 


6.5 SERIALIZATION OF NOTIFICATION OF MULTIPLE EVENTS 


The interaction between arithmetic traps, tracing, other exceptions, and multiple interrupts is complex. In 
order to ensure consistent and useful implementations, it is necessary to understand this interraction at a 
detailed level. AS an example, if an instruction is started with T=1 and TP=0O, it gets an arithmetic trap, 
and an interrupt request is recognized, the following sequence occurs: 


e The instruction finishes, storing all its results. PSL<TP> is set at the end of this instruction 
since PSL<T> was set at the beginning. 


° The overflow trap sequence is initiated, pushing the PC and PSL (with TP=1), loading a new 
PC from the vector, and creating a new PSL. 


° The interrupt sequence is initiated, pushing the PC and PSL appropriate to the overflow trap 
service routine, loading a new PC from the vector, and creating a new PSL. 


e If a higher priority interrupt is noticed, the first instruction of the interrupt service routine is 
not executed. Instead, the PC and PSL appropriate to that routine are saved as part of initiating 
the new interrupt. The original interrupt service routine will then be executed when the higher 
priority routine terminates via REI. 


° The interrupt service routine runs, and exits with REI. 


° The overflow trap service routine runs, and exits with REI, which sets PSL<TP> since the 
saved PSL<TP> was set. 
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e The trace fault occurs, again pushing PC and PSL but this time with TP=0. 
° Trace service routine runs, and exits with REl. 


e The next instruction is executed. 


This is accomplished by the following operation between instructions: 


there at completion of instruction including 
! at end of REI from an exception or interrupt routine 


1$: {possibly take interrupts or console halt}; 
!PSL<TP> is not modified before PSL is saved 
if PSL<TP> EQLU 1 then fif trace pending, take trace fault 
begin {Trace fault takes precedence 
PSL<TP> <- 0; fover other exceptions. 
{initiate trace fault}: 
end; 


{possibly take interrupts or console halt}; 
!'PSL<TP> is not modified before PSL is saved 


PSL<TP> <- PSL<T>; !if trace enable, set trace pending 


{go start instruction execution}; 
'Reserved instruction faults are taken here 
!'FPD 1s tested here, thus TP takes 
! precedence over FPD if both are set. 
if {instruction faults} OR {an interrupt or console halt 
is taken before end of instruction} then 
begin 
{back up PC to start of opcode}; 
{either set PSL<FPD> or back up all general 
register side effects}; 
PSL<TP> <- Q; 
{initiate exception or interrupt}; 


if {arith trap needed and no other abort 
or trap} then {initiate arith trap}; 


end; 
{note: all instructions end by flowing 


! through 1$, thus the REI from a service 
! routine will return to 1S 
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6.6 SYSTEM CONTROL BLOCK (SCB) 


The System Control Block is a page containing the vectors by which exceptions and interrupts are dispatched 
to the appropriate service routines. 


6.6.1 System Control Block Base (SCBB) 

The SCBB is a privileged register containing the physical address of the System Control Block, which must 
be page-aligned. 

33 2 

109 9 8 0) 


Bz Physical page address of SCB | wz 


System Control Block Base 


At bootstrap time, the contents of SCBB is UNPREDICTABLE. The actual length is implementation dependent 
because it represents a physical address. 


6.6.2 Vectors 


A vector is a longword in the SCB that is examined by the processor when an exception or interrupt occurs, 
to determine how to service the event. 


Separate vectors are defined for each interrupting device controller and each class of exceptions. Each 
vector is interpreted as follows by the hardware. Bits 1:0 contain a code interpreted: 


e Service this event on the kernel stack unless already running on the interrupt stack, in which 
case service on the interrupt stack. 


° Service this event on the interrupt stack. If this event is an exception, the IPL is raised to 1F 
(hex). 
e Service this event in writable control store, passing bits 15:2 to the installation-specific microcode 


there. If writable control store does not exist or is not loaded, the operation is UNDEFINED. 
On the VAX-11/780 processor, the operation in this case is a HALT. 


e Operation UNDEFINED. Reserved to DIGITAL. On the VAX-11/780 processor, the operation is 
a HALT. 


For codes 0 and 1, bits 31:2 contain the virtual address of the service routine, which must begin on a 
longword boundary and will ordinarily be in the system space. CHMx is serviced on the stack selected by 
the new mode. Bits <1:0> in the CHMx vectors must be zero or the operation is UNDEFINED. On the 
VAX-11/780 processor, these bits are ignored in the CHMx vectors. 
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6.6.3 System Control Block Layout 


Vector Name 

(hex) 

00 Unused 

04 Machine Check 

08 Kernel Stack Not Valid 

OC Power Fail 

10 Reserved/Privileged 
Instruction 

14 Customer Reserved 
Instruction 

18 Reserved Operand 


Number of 


Type Params 
Abort/ * 
Fault/ 

Trap 

Abort 0 


Interrupt 0 


Fault 0 


Fault 0 
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Notes 


Reserved to DIGITAL. 


Processor-and error- 
specific information 
is pushed on the 
stack, if possible. 
Restartability is 
processor specific. 


If vector<1:0> isl, 
IPL is raised to 1F(hex) 
and the interrupt stack 
is used (i.e. IS <- 1). 
If vector<1:0> is 0O, 
operation 1S UNDEFINED. 


* -- the number of bytes 
of parameters 1s pushed 
on the stack and is 
implementation dependent. 


If vector<1l:0> is l, 
IPL is raised to 1F(hex) 
and the interrupt stack 
is used (i.e. IS <- 1). 
If vector<l:0> is 0, 
operation is UNDEFINED. 


IPL 1S raised 
to 1E (hex). 


Opcodes reserved to 
DIGITAL and 
privileged instructions. 


XFC instruction. 
Type depends on 


circumstances. See section 
on reserved operand 
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1C 
20 


24 


28 
2C 


30 


34 


38-3C 
40 


44 


48 


4C 


90-60 


64-80 


Reserved Addressing Mode Fault 


Access Control Violation Fault 


Translation Not Valid 


Trace Pending (TP) 


Breakpoint Instruction 


Compatibility 


Arithmetic 


Unused 


CHMK 


CHME 


CHMS 


CHMU 


Reserved for System 
Bus and Memory Errors 


Unused 


Fault 


Fault 
Fault 


Fault/ 
Abort 


Trap/ 


Fault 


Trap 


Trap 


Trap 


Trap 


Interrupt 
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exceptions. 


Virtual address 
causing fault is 
pushed onto stack. 
See chapter 5. 


Virtual address 
causing fault is 
pushed onto stack. 
See chapter 5. 


A type code is pushed 
onto the stack. See sect 
on compatibility mode 
exceptions. 


A type code is pushed 
onto the stack. 


Reserved to DIGITAL. 


The operand word is 
Sign extended and 
pushed onto the stack. 
Vector<1l:0> MBZ. 


The operand word is 
Sign extended and 
pushed onto the stack. 
Vector<1:0> MBZ. 


The operand word is 
Sign extended and 
pushed onto the stack. 
Vector<1l:0> MBZ. 


The operand word is 
Sign extended and 
pushed onto the stack. 
Vector<1:0> MBZ. 


IPL is implementation 
dependent. 


Reserved to DIGITAL. 
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84 Software Level l Interrupt 0 

88 Software Level 2 Interrupt 0 Ordinarily used for 
AST delivery. 

8C Software Level 3 Interrupt 0 Ordinarily used for 
Process Scheduling. 

90-BC Software Levels 4-F Interrupt 0 

CO Interval Timer Interrupt 0 IPL is 16 or 18 (hex). 

C4 Unused Reserved to DIGITAL 

C8 Emulated Instructions Fault 12 FPD clear. MicroVAX. 

CC Emulated Instructions Fault 12 FPD set. MicroVAX. 

DO-DC Unused Reserved to DIGITAL 

E0-EC Unused Reserved to CSS/Customer 

FO Console Storage Rec. Interrupt 0 11/750 and 11/730.IPL is 
implementation dependent 

F4 Console Storage Trans. Interrupt 0 11/750 and 11/730.IPL is 
implementation dependent 

F8 Console Terminal Rec. Interrupt 0 IPL is 14 (hex). 

FC Console Terminal Trans. Interrupt 0 IPL is 14 (hex). 

100-1FC Adapter Vectors Interrupt 0 


Only interrupt priority levels 14 to 17 (hex) are available to a NEXUS external to the CPU, and there is a 
limit of 16 such NEXUS. A NEXUS is a connection on the system backplane bus (for example, the SBI), 
which is the internal interconnection structure. The NEXUS vectors are assigned as follows: 


100-13C IPL 14 (hex) NEXUS 0-15 
140-17C IPL 15 (hex) NEXUS 0-15 
180-1BC IPL 16 (hex) NEXUS 0-15 
1C0-1FC IPL 17 (hex) NEXUS 0-15 
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200-3FC Device Vectors Interrupt 0 


The use of a second SCB page is implementation dependent. In some processors 
(VAX-11/750 AND VAX-11/730), UNIBUS devices interrupt the processor directly. 
The vector is determined by adding 200 (hex) to the vector supplied by the device. 
Only device vectors in the range 0 to 1FC (hex) are allowed. Interrupt priority levels 
14 to 17 (hex) correspond to UNIBUS levels BR4 to BR7. 


400-5FC Device Vectors Interrupt 0 


The use of a third SCB page is implementation dependent. This page is used to 
directly vector device interrupts from the second Unibus on the VAX-11/750. The 
vector is determined by adding 400 (hex) to the vector supplied by the device. Only 
device vectors in the range 0 to 1FC (hex) are allowed. Interrupt priority levels 14 
to 17 (hex) correspond to UNIBUS levels BR4 to BR7. 


6.7 STACKS 


At any time, the processor is either in a process context (IS=0) in one of four modes (kernel, exec, super, 
user), or in the system-wide interrupt service context (IS=1) that operates with kernel privileges. There is 
a stack pointer associated with each of these five states, and any time the processor changes from one of 
these states to another, SP (R14) is stored in the process context stack pointer for the old state and loaded 
from that for the new state. The process context stack pointers (KSP=kernel, ESP=exec, SSP =super, 
USP =user) are allocated in the PCB (see Chapter 7), although some hardware implementations may keep 
them in privileged registers. The interrupt stack pointer (ISP) is in a privileged register. 


Operating system design must choose a priority level that is the boundary between kernel and interrupt 
stack use. The SCB interrupt vectors must be set such that interrupts to levels above this boundary run on 
the interrupt stack (vector<1:0> = 1) and interrupts below this boundary run on the kernel stack (vector<1:0> 
= 0). Typically, AST delivery (IPL 2) is on the kernel stack and all higher levels are on the interrupt stack. 


6.7.1 Stack Residency 


The USER, SUPER, and EXEC stacks do not need to be resident. The kernel can bring in or allocate 
process stack pages as Address Translation Not Valid faults occur. However, the kernel stack for the current 
process, and the interrupt stack (which is process-independent) must be resident and accessible. Translation 
Not Valid and Access Control Violation faults occurring on references to either of these stacks are regarded 
as serious system failures, from which recovery is not possible. 


If either of these faults occurs on a reference to the kernel stack, the processor aborts the current sequence 
and initiates Kernel Stack Not Valid abort on hardware level 1F (hex). If either of these faults occurs on a 
reference to the interrupt stack, the processor halts. Note that this does not mean that every possible 
reference is checked, but rather that the processor will not loop on these conditions. 
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It is not necessary that the kernel stack for processes other than the current one be resident, but it must 
be resident before a process is selected to run by the software’s process dispatcher. Further, any mechanism 
that uses Translation Not Valid or Access Control Violation faults to gather process statistics, for instance, 
must exercise care not to invalidate kernel stack pages. 


6.7.2 Stack Alignment 


Except on CALLx instructions, the hardware makes no attempt to align the stacks. For best performance 
on all processors, the software should align the stack on a longword boundary and allocate the stack in 
longword increments. The convert byte to long (CVTBL and MOVZBL), convert word to long (CVTWL and 
MOVZWL), convert long to byte (CVTLB), and convert long to word (CVTLW) instructions are recommended 
for pushing bytes and words on the stack and popping them off in order to keep it longword aligned. 


6.7.3 Stack Status Bits 


The interrupt stack bit (IS) and current mode bits in the privileged Processor Status Longword (PSL) specify 
which of the five stack pointers is currently in use as follows: 


Is MODE REGISTER 


ISP 
KSP 
ESP 
SSP 
USP 


OOOO FrF 
WHF OO 


The processor does not allow current mode to be non-zero when IS=1. This is achieved by clearing the 
mode bits when taking an interrupt or exception, and by causing reserved operand fault if REI attempts to 
load a PSL in which both IS and mode are non-zero. 


The stack to be used for an interrupt or exception is selected by the current PSL<IS> and bits <1:0> of 
the vector for the event as follows: 


vector<1:0> 


00 oni 
pS : eaeteaheen + 
Oo | KSP | ISP | 
PSL<IS> Se en as fee ee ie 
1 | ISP | ISP | 
+----- +—-—--—-—— + 


Values 10 (binary) and 11 (binary) of the vector<1:0> are used for other purposes. Refer to section on SCB 
vectors for details. 
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6.7.4 Accessing Stack Registers 


Reference to SP (the stack pointer) in the general registers will access one of five possible architecturally 
defined stack pointers; the user, supervisor, executive, kernel, or interrupt stack pointer, depending on the 
values of the current mode and IS bits in the PSL. Some processors might implement these five stack 
pointers as five internal processor registers. On these processors, software can access any of the five stack 
pointers not currently selected by the current mode and IS bits in the PSL via the MTPR and MFPR 
instructions. Results are correct even if the stack pointer specified by the current mode and IS bits in the 
PSL is referenced in the processor register space by an MTPR or MFPR instruction. If the process stack 
pointers are implemented as registers, then these instructions are the only method for accessing the stack 
pointers of the current process. If the process stack pointers are kept only in the PCB, MTPR and MFPR 
of these registers access the PCB. See Chapter 9 for conventions to be followed when referencing per-process 
registers that are also in the processor register space. 


The internal processor register numbers were chosen to be the same as PSL<26:24> (see Chapter 9). The 
previous stack pointer is the same as PSL<23:22> unless PSL<IS> is set. If PSL<IS> is set, the previous 


mode cannot be determined from the PSL since interrupts always clear PSL<23:22>. At bootstrap time, the 
contents of all stack pointers are UNPREDICTABLE. 


6.8 INITIATE EXCEPTION OR INTERRUPT 


Condition Codes (if vector<1:0> code is 0 or 1): 


N <- Q; 
Z<- Q; 
V <- Q; 
C <= 0% 


Exceptions: 


interrupt stack not valid 
kernel stack not valid 


Description: 


The handling is determined by the contents of a longword vector in the system control block which is 
indexed by the exception or interrupt being processed. If the processor is not executing on the interrupt 
stack, then the current stack pointer is saved and the new stack pointer is fetched. The old PSL is pushed 
onto the new stack. The PC is backed up (unless this is an interrupt between instructions or a trap) and 
is pushed onto the new stack. The PSL is initialized to a canonical state. IPL is changed if this is an 
interrupt or if it is an exception with vector<1:0> code 1. Any parameters are pushed. Except for interrupts, 
the previous mode in the new PSL is set to the old value of the current mode. Finally, the PC is changed 
to point to the longword indicated by the vector<31:2>. 


Notes: 


° Interrupts are disabled during this sequence. 
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If the vector<1:0> code is invalid, the behavior is UNDEFINED. 


On a fault or interrupt, the saved condition codes are UNPREDICTABLE; they are only saved 
to the extent necessary to ensure correct completion of the instruction when resumed. 


After an abort, the following are UNPREDICTABLE: 


1. destination operands, including implied operands such as the top of the stack during a 
JSR instruction. 


2. registers modified by operand specifier evaluation, including registers modified by 
referencing implied operands. 


3. condition codes 

4. PSL<FPD> 

5. PSL<TP> 

6. the page table entry Modify bit for pages mapping write or modify type operands. The 


Modify bit will be set if the instruction modified the page. If the instruction did not modify 
the page, the Modify bit is UNPREDICTABLE. 


After an abort, the PC pushed on the stack addresses the instruction which aborted, unless the instruction 
modified PC in a way that produces UNPREDICTABLE results. The other registers, other bits of the PSL, 
and the rest of memory are unaffected by an abort. 


After an abort or fault or interrupt that pushes a PSL with FPD set, the general registers 
except PC, SP and FP are UNPREDICTABLE unless the instruction description specifies a 
setting. If FP is the destination in this case, then it is also UNPREDICTABLE. On a Kernel 
Stack Not Valid abort, both SP and FP are UNPREDICTABLE. This implies that processes 
stopped with FPD set cannot be resumed on processors of a different type or engineering 
change level. 


If the processor gets an Access Control Violation or a Translation Not Valid condition while 
attempting to push information on the kernel stack, a Kernel Stack Not Valid abort is initiated 
instead. The additional information, if any, associated with the original exception is lost. However 
PSL and PC are pushed on the interrupt stack with the same values as would have been 
pushed on the kernel stack, and IPL is changed to 1F (hex). If vector<1:0> for Kernel Stack 
Not Valid Abort is 0, the operation of the processor is UNDEFINED. 


If the processor gets an Access Control Violation or a Translation Not Valid condition while 
attempting to push information on the interrupt stack, the processor is halted and only the 
state of ISP, PC, and PSL is ensured to be correct for subsequent analysis. The PSL and PC 
have the values that would have been pushed on the interrupt stack. 


The value of PSL<TP> that is saved on the stack is as follows: 
fault clear 


trace clear 
interrupt clear (if FPD set) 
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from PSL<TP> (if after traps, before tra 


abort UNPREDICTABLE 
trap from PSL<TP> 
CHMx from PSL<TP> 
BPT, XFC clear 
reserv.instr. clear 
° The value of PC that is saved on the stack points to the following: 
fault instruction faulting 
trace next instruction to execute 


1.@. instruction at the beginning of which 
the trace fault was taken. 


interrupt instruction interrupted or 
next instruction to execute 
abort instruction aborting or 


detecting Kernel Stack Not Valid 
(not ensured on machine check) 


trap next instruction to execute 
CHMx next instruction to execute 
BPT, XFC BPT, XFC instruction 
reserv.instr. reserv.instr. 
e The non-interrupt stack pointers may be fetched and stored by hardware in either privileged 


registers or in their allocated slots in the PCB. Only LDPCTX and SVPCTX always fetch and 
store in the PCB, see Chapter 7. MFPR and MTPR always fetch and store the pointers whether 


in registers or the PCB. 
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6.9 RELATED INSTRUCTIONS 


REI Return from Exception or Interrupt 
Format: 

Opcode 
Operation: 

tmpl <- (SP)+; ! Pick up saved PC 

tmp2 <- (SP)+; ! and PSL 


if {tmp2<CUR_MOD> LSSU PSL<CUR_MOD>} OR 
{tmp2<IS> EQLU 1 AND PSL<IS> EQLU 0} OR 
{tmp2<IS> EQLU 1 AND tmp2<CUR_MOD> NEQU 0} OR 
{tmp2<IS> EQLU 1 AND tmp2<IPL> EQLU 0} OR 
{tmp2<IPL> GTRU 0 AND tmp2<CUR_MOD> NEQU 0} OR 
{tmp2<PRV_MOD> LSSU tmp2<CUR_MOD>} OR 
{tmp2<IPL> GTRU PSL<IPL>} OR 
{tmp2<PSL MBZ> NEQU 0} then {reserved operand fault}; 
if {compatibility mode implemented} then 


begin 
if {tmp2<CM> EQLU 1} AND 
{{tmp2<FPD,1IS,DV,FU,IV> NEQU 0} OR 
{tmp2<CUR_MOD> NEQU 3}} then {reserved operand fault}; 
end 


else if {tmp2<CM> EQLU 1} then {reserved operand fault}; 


if PSL<IS> EQLU 1 then ISP <- SP {save old stack pointer 
else PSL<CUR MOD>_SP <- SP; 
if PSL<TP> EQLU 1 then tmp2<TP> <- 1; {TP <- TP or stack TP 


PC <- tmpl; 
PSL <- tmp2; 
if PSL<IS> EQLU 0O then 


begin 

SP <- PSL<CUR_MOD>_SP; !'switch stack 

1£ PSL<CUR_MOD> GEQU ASTLVL !'check for AST delivery 
then {request interrupt at IPL 2}; 

end; 


{check for software interrupts}; 
{clear instruction look-ahead} 


Condition Codes: 


<- saved PSL<3>; 
<- saved PSL<2>; 
saved PSL<1>; 
<- saved PSL<0>; 


ASNS 
A 
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Exceptions: 
reserved operand 
Opcodes: 


02 REI Return from Exception or Interrupt 


Description: 


A longword is popped from the current stack and held in a temporary PC. A second longword is popped 
from the current stack and held in a temporary PSL. Validity of the popped PSL is checked. The current 
stack pointer is saved and a new stack pointer is selected according to the new PSL CUR_MOD and IS 
fields (see section on Stack Status Bits). The level of the highest privilege AST is checked against the 
current mode to see whether a pending AST can be delivered; refer to chapter 7. Execution resumes with 
the instruction being executed at the time of the exception or interrupt. Any instruction lookahead in the 
processor is reinitialized. 


Notes: 


° The exception or interrupt service routine is responsible for restoring any registers saved and 
removing any parameters from the stack. 


e As usual for faults, any Access Violation or Translation Not Valid conditions on the stack pops 
restore the stack pointer and fault. 


e The non-interrupt stack pointers may be fetched and stored either in privileged registers or in 
their allocated slots in the PCB. Only LDPCTX and SVPCTX always fetch and store in the 
PCB (see Chapter 7). MFPR and MTPR always fetch and store the pointers whether in registers 
or the PCB. 


e REI to compatibility mode results in a reserved operand fault if compatibility mode is not 
implemented. 
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CHM Change Mode 
Purpose: request services of more privileged software 
Format: 

opcode code.rw 
Operation: 


tmpl <- {mode selected by opcode (K=0, E=1l, S=2, U=3)}; 


tmp2 <- MINU(tmpl, PSL<CUR MOD>); !maximize privilege 
tmp3 <- SEXT(code); 

if {PSL<IS> EQLU 1} then HALT; !illegal from I stack 
PSL<CUR_MOD>_SP <- SP; !save old stack pointer 
tmp4 <- tmp2_ SP; !get new stack pointer 
PROBEW (from tmp4-1 through tmp4-12 with mode=tmp2); !'check 


! new stack access 
if {access control violation} then 
{initiate access violation fault}; 
if {translation not valid} then 
{initiate translation not valid fault}; 


{initiate CHMx exception with new mode=tmp2 
and parameter=tmp3 
using 40+tmp1*4 (hex) as SCB offset 
uSing tmp4 as the new SP 
and not storing SP again}; 


Condition Codes: 


N <- 0; 

Z<- QO; 

V <- QO; 

Cc <= 0s 
Exceptions: 

halt 
Opcodes: 


BC CHMK Change Mode to Kernel 

BD CHME Change Mode to Executive 
BE CHMS Change Mode to Supervisor 
BF CHMU Change Mode to User 


Description: 


Change Mode instructions allow processes to change their access mode in a controlled manner. The 
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instruction only increases privilege (i.e., decreases the access mode). 


A change in mode also results in a change of stack pointers; the old pointer is saved, the new pointer is 
loaded. The PSL, PC, and code passed by the instruction are pushed onto the stack of the new mode. 
The saved PC addresses the instruction following the CHMx instruction. The code is sign extended. After 
execution, the new stack’s appearance is: 


The destination mode selected by the opcode is used to obtain a location from the System Control Block. 
This location addresses the CHMx dispatcher for the specified mode. If the vector<1:0> code NEQU 0 then 
the operation is UNDEFINED. 


Notes: 

e As usual for faults, any Access Violation or Translation Not Valid fault saves PC, PSL, and 
leaves SP as it was at the beginning of the instruction except for any pushes onto the kernel 
stack. 

e The non-interrupt stack pointers may be fetched and stored either in privileged registers or in 
their allocated slots in the PCB. Only LDPCTX and SVPCTX always fetch and store in the 
PCB, see Chapter 7. MFPR and MTPR always fetch and store the pointers whether in registers 
or the PCB. 

° By software convention, negative codes are reserved to CSS and customers. 

Examples: 
CHMK #7 srequest the kernel mode service 
; specified by code 7 
CHME #4 ;request the executive mode service 
+ specified by code 4 
CHMS #-2 ;request the Supervisor mode service 


> specified by customer code -2 
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6.10 PROCESSOR STATE TRANSITION TABLE 


FINAL STATE 


\ User Super Exec Kernel Kernel Kernel Program 
INITIAL IS=0 IS=0 IS=0 IS=0 IS=0 IS=1 Halt 
STATE IPL=0 IPL=0 IPL=0 IPL=0 IPL>0 IPL>0O 


CHMK |Inter(0) |Excep(1) 

Excep (0) Inter (1) 

CHMK |Inter(0) |Excep(1) 

Excep (0) Inter (1) 

CHMU,S,E| CHMK J|Inter(0) |Excep(1) 
REI Excep (0) Inter (1) 


CHMUSEK 
REI* 


CHMUSEK 
RET* REI* 
Excep (0) 
Inter (0) 
MTPR IPL 
LDPCTX 
SVPCTX 
REI* REI* LDPCTX REI 
REI* Excep 
Inter 
MTPR IPL 


0 
1 


Inter is Interrupt (0) is vector<1:0> 
Excep is Exception (1) is vector<1:0> 


* Any REI that increases mode can cause an 
interrupt request at IPL 2 for AST delivery. 


[End of Chapter 6] 
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CHAPTER 7 


PROCESS STRUCTURE 


7.1 PROCESS DEFINITION 


A process is a single thread of execution. It is the basic schedulable entity that is executed by the processor. 
A process consists of an address space and both hardware and software context. The hardware context of 
a process is defined by a Process Control Block (PCB) that contains images of the 14 general purpose 
registers, the processor status longword (PSL), the program counter (PC), the 4 per-process stack pointers, 
the process virtual memory defined by the base and length registers POBR, POLR, P1BR, and P1LR and 
several minor control fields. In order for a process to execute, the majority of the PCB must be moved 
into the internal registers. While a process is executing, some of its hardware context is being updated in 
the internal registers. When a process is not being executed its hardware context is stored in a data structure 
termed the Process Control Block (PCB). Saving the contents of the privileged registers in the PCB of the 
currently executing process and then loading a new context from another PCB is termed context switching. 
Context switching occurs as one process after another is scheduled for execution. 


7.2 PROCESS CONTEXT 


7.2.1 Process Control Block Base (PCBB) 


The process control block for the currently executing process is pointed to by the content of the Process 
Control Block Base (PCBB) register, an internal privileged register. Figure 7.1 depicts the Process Control 
Block Base. 


33 2 

109 210 

Bz. physical longword address of PCB Bz 
(read/write) 


Figure 7-1 Process Control Block Base (PCBB) Register 
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At bootstrap time, the contents of PCBB is UNPREDICTABLE. 


7.2.2 Process Control Block (PCB) 


The process control block (PCB) contains all of the switchable process context collected into a compact 
form for ease of movement to and from the privileged internal registers. Although in any normal operating 
system there is additional software context for each process, the following description is limited to that 
portion of the PCB known to the hardware. Figure 7-2 depicts the PCB, whose contents are described in 
Table 7-1. 
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Figure 7-2 Process Control Block (PCB) 
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Longword 


0 


21 


21 


21 


Bits 


€31:0> 


€31:0> 


<31:0> 


<31:0> 


€31:0> 


€31:0> 


€31:0> 


€31:0> 


<21:0> 


€23:22> 


<26:24> 
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Table 7-1 


Description of Process Control Block 


Mnemonic 


KSP 


ESP 


SSP 


USP 


RO-R11, 
AP,FP 


PC 
PSL 


POBR 


POLR 


MBZ 


ASTLVL 


Description 


Kernel Stack Pointer. Contains the stack pointer to be 
used when the current access mode field in the PSL 
is O and IS = O. 


Executive Stack Pointer. Contains the stack pointer to 
be used when the current access mode field in the 
PSL is 1. 


Supervisor Stack Pointer. Contains the stack pointer to 
be used when the current access mode field in the 
PSL is 2. 


User Stack Pointer. Contains the stack pointer to be 
used when the current access mode field in the PSL 
is 3. 


General registers RO through R11, AP, FP 


Program Counter. 
Program Status Longword. 


Base register for page table describing process virtual 
addresses from 0 to 2**30-1. See chapter 5. 


Length register for page table located by POBR. 
Describes effective length of page table. See chapter 
5. 


Must be zero. 


Contains access mode number (established by software) 
of the most privileged access mode for which an AST 
is pending. Controls the triggering of the AST delivery 
interrupt during REI instructions. ASTLVL is interpreted 
as follows: 


0 AST pending for access mode 0 (kernel) 
1 AST pending for access mode 1 (executive) 
2 = AST pending for access mode 2 (supervisor) 
3 = AST pending for access mode 3 (user) 
4 
5- 


No pending AST 
7 = Reserved to DIGITAL 
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21 <31:27> MBZ Must be zero. 

22 <31:0> P1BR Base register for page table describing process virtual 
addresses from 2**30 to 2**31-1. See chapter 5. 

23 <€21:0> P1LR Length register for page table located by P1BR. 
Describes effective length of page table. See chapter 
5. 

23 <30:22> MBZ Must be zero. 

23 <31> PME Performance Monitor Enable controls a signal visible to 


an external hardware performance monitor. This bit is 
set to identify those processes for which monitoring is 
desired and to permit their behavior to be observed 
without interference from other system activity. 


Software symbols for these locations consist of the prefix PTX$L_ and the mnemonic. For example, the 
PCB offset to R3 is PTX$L_R3. Exceptions are longwords 21 and 23, for which the software symbols are: 


PTXSL POLRASTL longword 21 
PTXSL_ P1LRPME longword 23 


To alter its POBR, P1BR, POLR, PiLR, ASTLVL or PME, a process must be executing in kernel mode. It 
must first store the desired new value in the memory image of the PCB then move the value to the 
appropriate privileged register. This protocol results from the fact that these are read-only fields (for the 
context switch instructions) in the PCB. 


7.2.3 Process Privileged Registers 


The ASTLVL and PME fields of the PCB may be contained in registers (see Chapter 9) when the process 
is running. In order to access them, two privileged registers are provided. Figure 7-3 depicts the AST Level 
Register. 


3 
1 32 O 
ignored; returns 0 AST- 
LVL 


(read/write) 


Figure 7-3 AST Level Register 
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An MTPR src,#ASTLVL with src<2:0> GEQU 5 results in a reserved operand fault. At bootstrap time, the 
contents of ASTLVL is 4. Note that loading ASTLVL with MTPR does not affect SISR or request a software 
interrupt. Those affects of ASTLVL occur only during REI. Figure 7-4 depicts the Performance Monitor 
Enable (PME) Register. 


3 

1 1 0 
P 
M 
E 


(read/write) 


Figure 7-4 Performance Monitor Enable Register 


At bootstrap time, PME is cleared. 


7.3 ASYNCHRONOUS SYSTEM TRAPS (AST) 


Asynchronous system traps are a technique for notifying a process of events that are not synchronized with 
its execution and initiating processing for asynchronous events with the least possible delay. This delay in 
delivery of the AST may be due to either process non-residence or an access mode mismatch. The efficient 
handling of AST’s in VAX requires some hardware assistance to detect changes in access mode (current 
access mode in PSL). A process in any of the four execution access modes (kernel, exec, Super, and user) 
may receive AST’s; however, an AST for a less privileged access mode must not be permitted to interrupt 
execution in a more protected access mode. Since outward access mode transitions occur only in the REI 
instruction, comparison of the current access mode field is made with a privileged register (ASTLVL) containing 
the most privileged access mode number for which an AST is pending. If the new access mode is greater 
than or equal to the pending ASTLVL, an IPL 2 interrupt is triggered to cause delivery of the pending AST. 


General Software Flow for AST processing: 


e An event associated with an AST causes software enqueuing of an AST control block to the 
software PCB and the software sets the ASTLVL field in the hardware PCB to the most 
privileged access mode for which an AST is pending. If the target process is currently executing, 
the ASTLVL privileged register also has to be set. 


e When an REI instruction detects a transition to an access mode that can be interrupted by a 
pending AST, an IPL 2 interrupt is triggered to cause delivery of the AST. Note that the REI 
instruction does not make pending AST checks while returning to a routine executing on the 
interrupt stack. 


° The (IPL 2) interrupt service routine should compute the correct new value for ASTLVL that 
prevents additional AST delivery interrupts while in kernel mode and move that value to the 
PCB and the ASTLVL register before lowering IPL and actually dispatching the AST. This 
interrupt service routine normally executes on the kernel stack in the context of the process 
receiving the AST. 
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e At the conclusion of processing for an AST, the ASTLVL is recomputed and moved to the 
PCB and ASTLVL register by software. 


7.4 PROCESS STRUCTURE INTERRUPTS 

Two of the software interrupt priorities are reserved for process structure software. 
They are: 

(IPL 2) - AST delivery interrupt. 


This interrupt is triggered by a REI that detects PSL<CUR_MOD> GEQU ASTLVL and indicates that a 
pending AST may now be delivered for the currently executing process. 


(IPL 3) - Process scheduling interrupt. 


This interrupt is only triggered by software to allow the software running at IPL 3 to cause the currently 
executing process to be blocked and the highest priority executable process to be scheduled. 


7.5 PROCESS STRUCTURE INSTRUCTIONS 


Process scheduling software must execute on the interrupt stack (PSL<IS> set) in order to have a 
non-context-switched stack available for use. If the scheduler were running on a process’s kernel stack, 
then any state information it had there would disappear when a new process is selected. Running on the 
interrupt stack can occur as the result of the interrupt origin of scheduling events, however some synchronous 
scheduling requests such as a WAIT service may want to cause rescheduling without any interrupt occurrence. 
For this reason, the Save Process Context (SVPCTX) instruction can be executed while on either the kernel 
or the interrupt stack and forces a transition to execution on the interrupt stack. 


All of the process structure instructions are privileged and require kernel mode. 
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LDPCTX Load Process Context 
Purpose: restore register and memory management context 
Format: 

opcode 
Operation: 


if PSL<CUR_MOD> NEQU 0 
then {privileged instruction fault}; 
{invalidate per-process translation buffer entries}; 
!PCB is located by physical address in PCBB 
if {internal registers for stack pointers} then 
begin 
KSP <- (PCB); 
ESP <- (PCB+t4); 
SSP <- (PCB+8); 
USP <- (PCB+12); 
end; 
RO <- (PCB+16); 
Rl <- (PCB+20); 
R2 <- (PCB+24); 
R3 <- (PCB+28); 
R4 <- (PCB+32); 
R5 <- (PCB+t36); 
R6 <- (PCB+40); 
R7 <- (PCB+44); 
R8 <- (PCB+48); 
RQ <- (PCB+52); 
R10 <- (PCB+56); 
Rll <- (PCB+60); 
AP <- (PCB+64); 
FP <- (PCB+68); 
tmpl <- (PCB+80); 
if {tmpl1<31:30> NEQU 2} OR {tmpl<1:0> NEQU 0} then 
{UNDEFINED}; 
POBR <- tmpl; 
if (PCB+84)<31:27> NEQU 0 then {UNDEFINED}: 
if (PCB+84)<23:22> NEQU 0 then {UNDEFINED}: 
POLR <- (PCB+84)<21:0>; 
if (PCB+84)<26:24> GEQU 5 then {UNDEFINED}; 
ASTLVL <- (PCB+84)<26:24>: 
tmpl <- (PCB+88); 
tmp2 <- tmpl + 2**23; 
if {tmp2<31:30> NEQU 2} OR {tmp2<1:0> NEQU 0} then 
{UNDEFINED}: 
PIBR <- tmpl; 
if (PCB+92)<30:22> NEQU O then {UNDEFINED}: 
PILR <- (PCB+92)<21:0>; 
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PME <- (PCB+92)<31>; 
if (PCB+92)<30:22> NEQU 0 then {UNDEFINED}: 
if PSL<IS> EQLU 1 then 

begin 

ISP <- SP; 

{interrupts off}; 

PSL<IS> <- Q; 


SP <- (PCB); !get KSP 
{interrupts on}; 
end; 
-(SP) <- (PCB+76); !'push PSL 
-(SP) <- (PCB+72); !push PC 


Condition Codes: 


N <- N; 
Z<- Z@: 
NO Ss 
Cs] Cs 
Exceptions: 
reserved operand 
privileged instruction 
Opcodes: 
06 LDPCTX Load Process Context 
Description: 


The Process Control Block is specified by the privileged register Process Control Block Base. The general 
registers are loaded from the PCB. The memory management registers describing the process address 
space are also loaded and the process entries in the translation buffer are cleared. Execution is switched 
to the kernel stack. The PC and PSL are moved from the PCB to the stack, suitable for use by a subsequent 
REI! instruction. 


Note: 
e Some processors keep a copy of each of the per-process stack pointers in internal registers. 
In those processors, LDPCTX loads the internal registers from the PCB. Processors that do 
not keep a copy of all four per-process stack pointers in internal registers, keep only the 
current access mode register in an internal register and switch this with the PCB contents 
whenever the current access mode field changes. 


e The preferred implementation of UNDEFINED operation is reserved operand abort. 


e To guarantee correct operation, a LDPCTX must be followed by an REI instruction. 
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Purpose: 


Format: 


Operation: 


SVPCTX Save Process Context 


save register context 


opcode 


if PSL<CUR MOD> NEQU 0 then 

{privileged instruction fault}; 
{PCB is located by physical address in PCBB 
if {internal registers for stack pointers} then 

begin 

(PCB) <- KSP; 

(PCB+4) <- ESP; 

(PCB+8) <- SSP; 

(PCB+12) <- USP; 

end; 
(PCB+16) <- RO; 
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(PCB+20) <- RI: 


(PCB+24) <- R2; 
(PCB+28) <- R3; 
(PCB+32) <- R4; 
(PCB+36) <- R5; 
(PCB+40) <- R6; 
(PCB+44) <- R7; 
(PCB+48) <- R8; 
(PCB+52) <- R9; 
(PCB+56) <- R10; 
(PCB+60) <- R11; 
(PCB+64) <- AP: 
(PCB+68) <- FP; 
(PCB+72) <- (SP)+; !pop PC 
(PCB+76) <- (SP)+; !pop PSL 


If PSL<IS> EBQLU O then 
begin 
PSL<IPL> <- MAXU(1, PSL<IPL>); 
(PCB) <- SP; !save KSP 
KSP <- SP; 
{interrupts off}; 
PSL<IS> <- 1; 
SP <- ISP; 
{interrupts on}; 
end; 
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Condition Codes: 


N <- N;3 
Zi > Le 
VS Vs 
©. <> sCe 
Exceptions: 
privileged instruction 
Opcodes: 
07 SVPCTX Save Process Context 
Description: 


The Process Control Block is specified by the privileged register Process Control Block Base. The general 
registers are saved into the PCB. The PC and PSL currently on the top of the current stack are popped 
and stored in the PCB. If a SVPCTX instruction is executed when IS is clear, then IS is set, the interrupt 
stack pointer activated, and IPL is maximized with 1 because of the switch to the interrupt stack. 


Notes: 


e The map, ASTLVL, and PME contents of the PCB are not saved because they are rarely 
changed. Thus, not writing them saves overhead. 


e Some processors keep a copy of each of the per-process stack pointers in internal registers. 
In those processors, SVPCTX stores the internal registers into the PCB. Processors that do 
not keep a copy of all four per-process stack pointers in internal registers, keep only the 
current access mode register in an internal register and switch this with the PCB contents 
whenever the current access mode field changes. 


e Between the SVPCTX instruction that saves state for one process and the LDPCTX that loads 
the state of another, the internal stack pointers may not be referenced by MFPR or MTPR 
instructions. This implies that interrupt service routines invoked at a priority higher than the 
lowest one used for context switching must not reference the process stack pointers. 
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7.6 USAGE EXAMPLE 


The following example illustrates how the process structure instructions can be used to implement process 
dispatching software. It is assumed that this simple dispatch routine is always entered via an interrupt. 


; ; ENTERED VIA INTERRUPT ; IPL=3 


RESCHED: SVPCTX ; Save context in PCB 


<set state to runnable> 
<and place current PCB> 
<on proper RUN queue> 


<Remove head of highest> 

<priority, non-empty, > 

<RUN queue.> 

MTPR @#PHYSPCB, PCBB ; Set physical PCB address 
‘in PCBB 

LDPCTX ; Load context from PCB 

; For new process 

REI ; Place process in execution 


[End of Chapter 7] 


CHAPTER 8 


SYSTEM ARCHITECTURE AND PROGRAMMING IMPLICATIONS 


8.1 INTRODUCTION 


Certain portions of the VAX architecture have implications on the system structure of implementations and 
programming considerations. The broad categories of interaction are: data sharing and synchronization, 
memory reference behavior, restartability, I/O structure, interrupts and errors. Of these, data sharing is most 
visible to the programmer. 


8.2 DATA SHARING AND SYNCHRONIZATION 


The memory system must be implemented such that the granularity of access for independent modification 
is the byte. Note that this does not imply a maximum reference size of one byte but only that independent 
modifying accesses to adjacent bytes produce the same results regardless of the order of execution. For 
example, suppose locations 0 and 1 contain the values 5 and 6. Suppose one processor executes INCB 0 
and another executes INCB 1. Then regardless of the order of execution, including effectively simultaneous, 
the final contents must be 6 and 7. 


Access to explicitly shared data that may be written must be synchronized by the programmer or hardware 
designer. Before accessing shared writeable data, the programmer must acquire control of the data structure. 
Seven instructions (BBSSI, BBCCI, ADAWI, INSQHI, INSQTI, REMQHI, REMQTI) are provided to allow the 
programmer to control ("interlock") access to a control variable. These interlocked instructions are implemented 
in such a way that once an interlocked read has occurred, other processors and I/O devices are locked 
out of performing interlocked operations on the same control variable until the interlock is released. This is 
termed an interlocked sequence. The interlocked instructions operate on a control variable within an interlocked 
sequence. Only interlocked accesses are locked out by the interlock. On the VAX-11/780, the SBI primitive 
operations are interlock read and interlock write. The interlocked read operation sets the interlock, and the 
interlocked write releases it. 


BBSSI and BBCCI instructions use hardware provided primitive operations to make a read reference, then 
test, and then make a write reference to a single bit within a single byte in an interlocked sequence. The 
ADAWI instruction uses a hardware provided primitive operation to make a read and then a write operation 
to a single aligned word in an interlocked sequence to allow counters to be maintained without other 
interlocks. The ADAWI instruction takes the hardware lock on the read of the .mw operand (the second 
operand which is the one being modified). 


The INSQUE and REMQUE instructions provide a series of longword reads and writes in an uninterruptible 
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sequence to allow queues to be maintained without other interlocks in a uniprocessor system. The INSQHI, 
INSQTI, REMQHI, and REMOQTI instructions use an interlock on the queue header to allow queues to be 
maintained consistently in a multiprocessor system. 


In order to provide a functionality upon which some UNIBUS peripheral devices rely, processors must insure 
that all instructions making byte or word sized modifying references (.mb and .mw) use the DATIP - DATO(B) 
functions when the operand physical address selects a UNIBUS device. This constraint does not apply to 
longword, quadword, field, all floating, or string operations if implemented using byte or word modifying 
references. This constraint also does not apply to instructions precluded from I/O space references (see 
Appendix A). 


In a multiprocessor system, any software clearing PTE<V> or changing the protection code of a page table 
entry for system space such that it issues a MTPR xxx,#TBIS must arrange for all other processors to issue 
a similar TBIS. The original processor must wait until all the other processors have completed their TBIS 
before it allows access to the system page. 


8.3 SEPARATION OF PROCEDURE AND DATA 


The VAX architecture encourages (and provides the mechanisms to facilitate) separation of procedure 
(instructions) and writable data. Native mode procedures may not write data which is to be subsequently 
executed as an instruction without an intervening REI instruction being executed (See Chapter 6). If no REI 
occurs between a procedure writing data as instructions to be executed, and those instructions being 
executed, the instructions executed are UNPREDICTABLE. A compatibility mode procedure can write data 
and subsequently execute it as an instruction without any additional synchronization. 


8.4 MEMORY REFERENCES 


The memory references made by each instruction (and therefore the possible memory exceptions) are a 
defined part of the VAX architecture. Any required or permitted memory reference (read, modify, or write) 
may be made more than once, except for references to I/O space which are made once and only once. 
Operands requiring interlocked access are always referenced. In general, for operands not requiring interlocked 
access, it is UNPREDICTABLE whether an operand is referenced if it does not affect the result (including 
condition codes). Further clarifications and exceptions to this simplified rule are listed below. Software must 
not rely on the occurrence of memory management exceptions on operands that do not affect the result 
of an instruction. The probe instructions should be used to determine the accessibility of a memory location. 
Note that no results are written unless the instruction can be completed or can be suspended with FPD 
set. 


e It is UNPREDICTABLE whether longwords containing indirect addresses are read. For example, 
MULL3 #0,@16(R5),A may or may not access the longword containing the address of the 
second operand. 


e lf a branch is not taken, it is UNPREDICTABLE whether the branch displacement is read. 
e It is UNPREDICTABLE whether all bytes for ".r" operands are read. For example, TSTF may 


only read the word containing the sign and exponent. BLBC and BLBS may only read the 
low byte of the source operand. 
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e All bytes for ".w" operands are always written. 


e It is UNPREDICTABLE whether all bytes for ".m" operands are either read (with modify intent) 
or written. However, a modify operand requiring interlocked read and write is always accessed. 
For example, ADDL2 #0,A may only read A (without modify intent). INCL A may only write 
the bytes of A that changed. The sum operand of ADAWI #0,A is always read and written 
back interlocked. 


° For ".a" operands (and for ".v" operands when ".v" is not a register), the memory reference 
behavior is peculiar to each instruction or instruction group: 


1. POLY{F,D,G,H}. If the argument is not zero, each entry in the coefficient table is read 
unless an arithmetic exception occurs before the instruction completes. If the argument 
is zero, it is UNPREDICTABLE whether the entire table or only the last coefficient is 
read. 


2. MOVA{B,W,L,Q,0} and PUSHA{B,W,L,Q,O}. The address operand is not referenced. 


3. Field Instructions (EXTV, EXTZV, INSV, CMPV, CMPZV, FFS, FFC). Only the aligned 
longword(s) containing the field specified by FIELD (pos, size, base) can be read. For 
INSV, only these aligned longword(s) can be written. It is UNPREDICTABLE whether all 
or some of the bytes in these longwords are accessed. 


4. BB{S,C}, BB{S,C}{S,C}. Only the single byte containing the test bit specified by the base 
and position operands is read. If the test bit does not need to change state, it is 
UNPREDICTABLE whether the byte is written back. 


5. BB{SS,CC}I. Only the single byte containing the test bit specified by the base and position 
operands is referenced using the interlocked forms of read and write. The test bit is 
written even if its state is unchanged. 


6. JMP and JSB. The address is not referenced by the JMP or JSB (but will be read as 
instruction stream data for the next instruction). 


rg CALL{S,G}. The two bytes (containing the entry mask) at the destination address are 
read. The argument list for CALLG is not referenced. 


8. Interlocked Queue. It is UNPREDICTABLE whether the backward pointer of the queue 
header is accessed for INSQHI, REMQHI. 


e Character String. Some of the string instructions (MOVTUC, CMPC3, CMPC5, SCANC, SPANC, 
LOCC, SKPC, and MATCHC) can stop before the whole source string is processed. Three 
definitions help define the required memory references for these instructions. 


The STOP byte is the byte that ends the instruction execution without using the string length 
end condition. It is the last byte on which the answer of the instruction depends. (The stop 
byte may have any position in the string, including first or last, or it may not exist at all. For 
string matches, it is the last byte of the matched string.) 
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A source string consists of a BODY concatenated with a TAIL. 


The BODY of a source string is the substring from the first byte up to and including the stop 
byte, if one exists, or up to and including the last byte (as determined by the source string’s 
length) if no stop byte exists. (The body may be null only if the source string has a zero 
length.) 


The TAIL of a source string is the substring from the first byte after the body up to and 
including the last byte in the source string as determined by the source string’s length. (The 
TAIL will be null if there is no stop byte or if the STOP byte is the last byte.) 


Character strings are defined by length and starting address. Some strings (e.g. ASCIZ strings) 
are delimited by a specific character. The "real" length of the string is not known and 64K is 
used as the length. Only some of the VAX character string instructions can be reasonably 
used on character delimited strings. These instructions are MOVTUC, SPANC, SCANC, LOCC, 
and SKPC. For these five instructions it is necessary to guarantee that no memory management 
exceptions will occur beyond the page containing the delimiting character. The absence of 
such a requirement could cause a program that works on one processor to fail on another 
due to access violations on data that is not necessary to produce the correct result. 


For string operands specified by length and starting address, one of the following rules applies: 


1. For MOVC3, MOVTC, and CRC, all bytes are referenced. These instructions have no 
end condition other than string length. 


2. For MOVCS5, the STOP byte is defined as the last byte moved from the source string. 
MOVC5 references all bytes except when the source string is longer than the destination 
string, in which case no bytes in the source string’s tail beyond the page containing the 
STOP byte are referenced. 


3. For CMPC3, CMPC5, and MATCHC, ail bytes in a string’s body are referenced. It is 
UNPREDICTABLE whether any bytes in a string’s tail are referenced. 


4, For MOVTUC, SCANC, SPANC, LOCC, and SKPC, all bytes in the source string’s body 
are referenced, and no bytes in the source string’s tail beyond the page containing the 
STOP byte are referenced. For MOVTUC, the destination address which would receive 
the translated escape character is not written into, nor is any larger address written into. 


For table operands, one of the following rules applies: 

1. In the table for MOVTC, MOVTUC, SCANC, and SPANC, entries are accessed for the 
corresponding source characters or values. It is UNPREDICTABLE whether the other 
table entries are accessed. 

2. For the CRC table operand, it is UNPREDICTABLE whether all or only part of the table 


is accessed. 


e EDITPC and Decimal strings. 
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If a packed decimal source string contains invalid digits, it is UNPREDICTABLE whether the entire source 
string is read and whether any or all of the destination is written. 


If there are no invalid digits in a packed decimal source string, one of the following rules applies: 


8.5 CACHE 


1. EDITPC, MOVP, ADDP6, SUBP6, MULP, DIVP, CVTPT, CVTTP, CVTPS, CVTSP, and 
ASHP. All bytes of the source strings are read, and all bytes of the result are written, 
unless an exception condition is detected and the instruction can be completed without 
reading all the bytes in the source strings. 


2. CMPP3 and CMPP4. It is UNPREDICTABLE whether all bytes of the two source strings 
are read. 


of ADDP4 and SUBP4. All bytes of the addend (or subtrahend) string are read. It is 
UNPREDICTABLE whether all bytes of the result are written. 


4. CVTLP. All bytes of the destination string are written. 
5. CVTPL. All bytes of the source string are read. 
6. EDITPC, CVTPT, CVTTP. The table entries are accessed for the corresponding source 


bytes. It is UNPREDICTABLE whether the other table entries are accessed. 


PROBER and PROBEW. The first and last bytes specified by the base and length operand 
are not accessed. 


A hardware implementation may include a mechanism to reduce access time by making local copies of 
recently used memory contents. Such a mechanism is termed a cache. A cache must be implemented in 
such a way that its existence is transparent to software (except for timing and error reporting/control/recovery). 
In particular, the following must be true: 


Program writes to memory followed by starting a peripheral output transfer must output the 
updated value. 


Completing a peripheral input transfer followed by the program reading of memory must read 
the input value. On the VAX-11/780, this is achieved by a cache that writes through to memory 
and that watches the memory bus for all external writes to memory. 


A write or modify followed by a HALT on one processor followed by a read or modify on 
another processor must read the updated value. 


A write or modify followed by a power failure followed by restoration of power followed by a 
read or modify must read the updated value provided that the duration of the power failure 
does not exceed the maximum non-volatile period of the main memory. 


In multiprocessor systems, access to variables shared between processors must be interlocked 
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by software executing one of the interlocked instructions (BBSSI, BBCCI, ADAWI, 
INSQHI,INSQTI,REMQHI,REMQT)I). 


e Valid accesses to I/O registers must not be cached. 


° A cache may prefetch instructions or data. In a virtual cache, memory management exception 
conditions could occur during prefetch. Such exceptions should not be taken until the prefetched 
data is referenced by an instruction. 


At bootstrap time, the cache must be either empty or valid. 


8.6 RESTARTABILITY 


The VAX architecture requires that all instructions be restartable after a fault or interrupt that terminated 
execution before the instruction was completed. Generally, this means that modified registers are restored 
to the value they had at the start of execution. For some complex or iterative instructions, indicated in 
Chapter 4, intermediate results are stored in the general registers. In the latter case memory contents may 
have been altered but the former case requires that no operand be written unless the instruction can be 
completed. For most instructions with only a single modified or written operand, this implies special processing 
only when a multibyte operand spans a protection boundary making it necessary to test accessibility of both 
parts of the operand. 


In order that instructions which store intermediate results in the general registers not compromise system 
integrity, they must insure that any addresses stored or used are virtual addresses, subject to protection 
checking, and that any state information stored or used cannot result in a non-interruptable or non-terminating 
sequence. 


Instruction operands that are peripheral device registers having access side effects may produce 
UNPREDICTABLE results due to instruction restarting after faults or interrupts. In order that software may 
dependably access peripheral device registers, instructions used to access them must not permit a fault or 
interrupt after the first I/O space access. The instructions and addressing modes that can be used to meet 
this condition are listed in Appendix A, "INSTRUCTIONS USABLE TO REFERENCE I/O SPACE." 


Memory modifications produced as a side effect of instruction execution, e.g. memory access statistics, are 
specifically excluded from the constraint that memory not be altered until the instruction can be completed. 


Instructions that abort are constrained only to insure memory protection (e.g., registers can be changed). 


8.7 INTERRUPTS 


Underlying the VAX architectural concept of an interrupt is the notion that an interrupt request is a static 
condition, not a transient event, which can be sampled by a processor at appropriate times. Further, if the 
need for an interrupt disappears before a processor has honored an interrupt request, the interrupt request 
can be removed (subject to implementation dependent timing constraints) without consequence. 


In order that software be able to operate deterministically it is necessary that any instruction changing the 
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processor priority (IPL) such that a pending interrupt is enabled must allow the interrupt to occur before 
executing the next instruction that would have been executed had the interrupt not been pending. 


Similarly, instructions that generate requests at the software interrupt levels (See Chapter 6) must allow the 
interrupt to occur, if processor priority permits, before executing the apparently subsequent instruction. 


8.8 ERRORS 


Processor errors, if not inconsistent with instruction completion, should create high priority interrupt requests. 
Otherwise, they must terminate instruction execution with an exception (fault, trap or abort), in which case 
there may also be an associated interrupt request. 


Error notification interrupts may be delayed from the apparent completion of the instruction in execution at 
the time of the error but if enabled, the interrupt must be requested before processor context is switched, 
priority permitting. 


An example of a case where both an interrupt and an exception are associated with the same event occurs 
when the VAX-11/780 instruction buffer gets a read data substitution (i.e. read memory data error). In this 
case the interrupt request associated with error will not be taken if the priority of the running program is 
high, but an abort will occur when an attempt is made to execute the instruction. However, the interrupt 
is still pending and will be taken when the priority is lowered. 


8.9 I/O STRUCTURE 


8.9.1 Introduction 


The VAX I/O architecture is very similar to the PDP-11 structure, the principal difference being the method 
by which privileged internal processor registers (such as the memory management registers) are accessed 
(see Chapter 9). Peripheral device control/status and data registers appear at locations in the physical address 
space, and can therefore be manipulated by normal memory reference instructions. On the VAX-11/780 
implementation, this 1/0 space occupies the upper half of the physical address space and is 2**29 bytes 
in length. Use of general instructions permits all the virtual address mapping and protection mechanisms 
described in Chapter 5 to be used when referencing I/O registers. Note: Implementations that include a 
cache feature must suppress caching for references in the I/O space. 


For any member of the VAX series implementing the UNIBUS, there will be one or more areas of the I/O 


physical address space each 2**18 bytes in length, which "maps through" to the UNIBUS addresses. The 
collection of these areas is referred to as the UNIBUS space. 


8.9.2 Constraints On I/O Registers 


The following is a list of both hardware and programming constraints on I/O registers. These items affect 
both hardware register design and programming considerations. 
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e The physical address of an I/O register must be an integral multiple of the register size in 
bytes, (which must be a power of two); ij.e., all registers must be aligned on natural boundaries. 


° References using a length attribute other than the length of the register and/or unaligned 
references may produce UNPREDICTABLE results. For example a byte reference to a 
word-length register will not necessarily respond by supplying or modifying the byte addressed. 


e In all peripheral devices, error and status bits that may be asynchronously set by the device 
must be cleared by software writing a "1" to that bit position and not affected by writing a 
"0". This is to prevent clearing bits that may be asynchronously set between reading and 
writing a register. 


° Only byte and word references of a read-modify-write (i.e., ".mb" or ".mw") type in UNIBUS 
I/O spaces are guaranteed to interlock correctly. References in the !/O space other than in 
UNIBUS spaces are UNDEFINED with respect to interlocking. This includes the BBSSI and 
BBCCI instructions. 


e String, quad, octa, F_floating, D_floating, G_floating, H_floating, and field references in the 
I/O space result in UNDEFINED behavior. 


e Page tables must not be located in I/O space. References to page table entries located in I/O 
space result in UNDEFINED behavior. 


[End of Chapter 8] 


CHAPTER 9 


PRIVILEGED REGISTERS 


9.1 PROCESSOR REGISTER SPACE 


The processor register space (PRS) provides access to many types of CPU control and status registers such 
as the memory management base registers, parts of the PSL, and the multiple stack pointers. These registers 
are explicitly accessible only by the Move to Processor Register (MTPR) and Move from Processor Register 
(MFPR) instructions which require kernel mode privileges. 


All the internal processor registers are summarized in the tables at the end of this section. Those which 
need further explanation are described below. Reference to general registers means RO through R13, the 
SP, and the PC (See Chapter 2). Registers referenced by the MTPR and MFPR instructions are designated 
processor registers, and appear in the processor register space. 


9.2 PER-PROCESS REGISTERS AND CONTEXT SWITCHING 


There are several per-process registers which are loaded from the PCB during a context load operation 
and, with the exception of the memory mapping registers, PME, and AST level, written back to the PCB 
during a context save operation (see Chapter 7). Some implementations may copy some or all of these 
registers from the PCB into scratchpad registers and write them back into the PCB during a context save 
operation. Other implementations may retain the registers in main memory in the PCB. 


An implementation may retain some or all per-process stack pointers only in the PCB. In this case, MTPR 
and MFPR for these registers must access the corresponding PCB location. However, implementations that 
have per-process stack pointers in hardware scratchpads are not required to access the corresponding PCB 
locations for MTPR and MFPR. The PCB locations get updated when a SVPCTX instruction is executed. 


It is possible that some implementations will retain some or all of the memory mapping registers (POBR, 
POLR, P1BR, P1LR), ASTLVL, and PME only in the PCB. These processors will implement MTPR and 
MFPR for those registers as a no-op, at least in the sense that the destination or register is not written. 
Other implementations may copy some or all of these registers from the PCB into scratchpad registers. The 
SVPCTX instruction does not write these registers back into the PCB. To ensure that the PCB is always 
correctly updated, software must use the following convention when referencing any of the memory mapping 
registers (POBR, POLR, P1BR, P1LR), or ASTLVL, or PME. 


e WRITE - Software must first write the value directly into the proper location in the current 
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PCB by using a INSV (for example) then execute an MTPR with the same source as the 
INSV. Implementations which do not retain internal copies of these registers will effectively 
no-op the MTPR instruction. They will not take a reserved operand fault which would normally 
occur for a non-existent register. 


° READ - Software can read the value directly from the proper location in the current PCB by 
using a EXTZV (for example). It is not necessary to execute a MFPR from the corresponding 
internal register, since the PCB location always contains an updated value due to the software 
convention for writing these registers. 


9.3 STACK POINTER IMAGES 


Reference to SP (the stack pointer) in the general registers will access one of five possible stack pointers; 
the user, supervisor, executive, kernel, or interrupt stack pointer, depending on the values of the current 
mode and IS bits in the PSL (see Chapter 6). Additionally, software can access any of the five stack pointers 
(including the one currently selected by the current mode and IS bits in the PSL) via the MTPR and MFPR 
instructions (even on processors that implement the KSP, SSP, ESP, or USP only in the PCB) Results are 
correct even if the stack pointer specified by the current mode and IS bits in the PSL is referenced in the 
PRS by an MTPR or MFPR instruction. This means that a MFPR/MTPR to the KSP (if 1S=0) or the ISP 
(if IS=1) is equivalent to a MOVL from/to the SP. 


9.4 MTPR AND MFPR INSTRUCTIONS 


The MTPR and MFPR instructions are used to access internal registers in the processor register space. 
These instructions are privileged and can be executed only in kernel mode. 
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MTPR Move To Processor Register 
Format: 
opcode src.rl, procreg.rl 
Operation: 
if PSL <CUR_MOD> NEQ 0 then {reserved 
instruction fault}: 


PRS[procreg] <- src; 


Condition Codes: 


N <- src LSS 0; !if register is replaced 

Z<- src EQL 0; 

V <- 0; !except TBCHK register (see Chapter 5) 
C <=“Cs 

N <- N; !if register is not replaced 

ZL: Se Ls 

V <- V; 

C <=-C> 


Exceptions: 


reserved operand fault 
reserved instruction fault 


Opcode: 


DA MTPR Move To Processor Register 


Description: 


Loads the source operand specified by source into the processor register specified by procreg. The procreg 
operand is a longword which contains the processor register number. Execution may have register-specific 
side effects. 


Notes: 
e A reserved instruction fault occurs if instruction execution is attempted in other than kernel 
mode. 
° A reserved operand fault occurs on a move to a read only register, or if the register does 


not exist. However, if a register is implemented only as a PCB location, a reserved operand 
fault does not occur. 
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MFPR Move From Processor Register 
Format: 
opcode procreg.rl, dst.wl 
Operation: 
if PSL <CUR_MOD> NEQ 0 then {reserved 
instruction fault}; 


dst <- PRS[procreg]; 


Condition Codes: 


N <- dst LSS 0; !if destination is replaced 

Z <- dst EQL 0; 

V <- 0; 

Cys ‘Ce 

N <- N; !if destination is not replaced 
Li. SoZ 2 

V <- V; 

Cs] Cs 


Exceptions: 


reserved operand fault 
reserved instruction fault 


Opcode: 


DB MFPR Move From Processor Register 


Description: 


The destination operand is replaced by the contents of the processor register specified by procreg. The 
procreg operand is a longword which contains the processor register number. Execution may have 
register-specific side effects. 


Notes: 
e A reserved instruction fault occurs if instruction execution is attempted in other than kernel 
mode. 
° A reserved operand fault occurs on a move from a write only register, or if the register does 


not exist. However, if a register is implemented only as a PCB location, a reserved operand 
fault does not occur. 
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9.5 VAX SERIES REGISTERS 


Register Name 


Kernel Stack Pointer 
Executive Stack Pointer 
Supervisor Stack Pointer 
User Stack Pointer 
Interrupt Stack Pointer 

PQ Base Register 

PQ Length Register 

Pl Base Register 

Pl Length Register 

System Base Register 
System Limit Register 
Process Control Block Base 
System Control Block Base 
Interrupt Priority Level 
AST Level 

Software Interrupt Request 
Software Interrupt Summary 
Interval Clock Control 
Next Interval Count 
Interval Count 

Time of Year 

Console Receiver C/S 
Console Receiver D/B 
Console Transmit C/S 
Console Transmit D/B 
Memory Management Enable 
Trans. Buf. Invalidate All 
Trans. Buf. 
Performance Monitor Enable 
System Identification 
Translation Buffer Check 


Legend: 


PROC - process specific, loaded by LDPCTX 
CPU - system-wide, not affected by LDPCTX 


MicroVAX implementations are not required to implement NICR, ICR, TODR, RXCS, 


Invalidate Single 


NOTE 


Type 
R/W 


Scope 


PROC 
PROC 
PROC 
PROC 
CPU 
PROC 
PROC 
PROC 
PROC 
CPU 
CPU 
CPU 
CPU 
CPU 
PROC 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
PROC 
CPU 
CPU 


RXDB, TXCS, TXDB, and PMR. Only a subset of ICCS is required. 
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9.5.1 System Identification Register (SID) 


The SID is a read only constant register that specifies the processor type. The entire SID register is included 
in the error log and the type field may be used by software to distinguish processor types. 


3 2 2 
1 43 0 
(read only) 
System Identification Register 
Type A unique number assigned by engineering to identify a specific processor: 
O = Reserved to DIGITAL (error) 
1 = VAX-11/780 
2 = VAX-11/750 
3 = VAX-11/730 
4 through 6 = Reserved to DIGITAL 
7 = microVAX-l 
8 = microVAX chip 
9 through 255 = Reserved to DIGITAL 
type specific format and content is a function of the value in type. It is intended to include such 


information as serial number and revision level. 


For the VAX-11/780, the type specific format is: 
2 1 1 
3 5 2 0) 


For the VAX-11/750, the type specific format is: 


1 
1 


i 


2 11 
3 6 5 8 7 0 


For the VAX-11/730, the type specific format is: 


2 1 1 
3 6 5 8 7 0 


RESERVED RESERVED 
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For systems based on the microVAX chip, the different system implementations can be distinguished by the 
contents of physical address 200403FC: 


3 2 1 1 
1 4 6 5 0 


SYS_TYPE type specific 


SYS_TYPE is a unique number assigned to identify a specific system: 


2 
3 


O = Reserved to DIGITAL (error) 
1 through 127 = Reserved to DIGITAL 
128 through 255 = Reserved to CSS and customers 


9.5.2 Console Terminal Registers 


The console terminal is accessed through four internal registers. Two are associated with receiving from 
the terminal and two with writing to the terminal. In each direction there is a control/status register and a 
data buffer register. 


3 
1 8765 0 
I 
E 
RR 
O W 
Console Receive Control/Status (RXCS) 
3 1 ii 1 i 
1 65 4 21 8 7 0 
ID DATA 


(read only) 
Console Receive Data Buffer (RXDB) 


At bootstrap time, RXCS is initialized to 0. Whenever a datum is received, the read only bit DONe is set 
by the console. If IE (interrupt enable) is set by the software then an interrupt is generated at IPL 20. 
Similarly, if DONe is already set and the software sets IE, an interrupt is generated (i.e., an interrupt is 
generated whenever the function {IE AND DON} changes from 0 to 1). If the received data contained an 
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error such as overrun or loss of connection then ERR is set in RXDB. The received data appears in DATA. 
When a MFPR #RXDB,dst is executed, DONe is cleared as is any interrupt request. If ID is O then the 
data is from the console terminal. If ID is non-zero then the entire register is implementation dependent. 


3 

al 8765 @) 
RII 
DIE 
Y 
RR 
O W 

Console Transmit Control/Status (TXCS) 
3 i i 
1 2. 4 8 7 0) 


(write only) 
Console Transmit Data Buffer (TXDB) 


At bootstrap time, TXCS is initialized with just the RDY bit set (ready). Whenever the console transmitter 
is not busy, it sets the read only bit RDY. If IE (interrupt enable) is set by the software then an interrupt 
is generated at IPL 20. Similarly, if RDY is already set and the software sets IE, an interrupt is generated 
(i.e., an interrupt is generated whenever the function {IE AND RDY} changes from 0 to 1). The software 
can send a datum by writing it to DATA. When a MTPR src,#TXDB is executed, RDY is cleared as is any 
interrupt request. If ID is written O then the datum is sent to the console terminal. If ID is non-zero then 
the entire register is implementation dependent. 


9.5.3 Clock Registers 


The clocks consist of a time of year clock and an interval clock. The time of year clock is used to measure 
the duration of power failures and is required for unattended restart after a power failure. The interval clock 
is used for accounting, for time dependent events, and to maintain the software date and time. 


9.5.3.1 Time-of-Year Clock - 


The time-of-year clock consists of one longword register. The register forms an unsigned 32-bit binary 
counter that is driven by a precision clock source with at least .0025% accuracy (approximately 65 seconds 
per month). The least significant bit of the counter represents a resolution of 10 milliseconds. Thus, the 
counter cycles to 0 after approximately 497 days. 


The counter has an optional battery back-up power supply sufficient for at least 100 hours of operation, 
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and the clock does not gain or lose any ticks during transition to or from stand-by power. The battery is 


recharged automatically. If the battery has failed, so that time is not accurate, then the register is cleared 
upon power up. One of two things then happens: 


e The register starts counting from 0. Thus, if software initializes this clock to a value corresponding 


to a large time (e.g., a month), it can check for loss of time after a power restore by checking 
the clock value. This is the VAX-11/780 implementation. 


The register stays at O until the software writes a non-zero value into it. It counts only when 
it contains a non-zero value. This is the VAX-11/750 implementation. 


3 
1 0 
time of year since setting 


(read/write) 


Time of Year (TODR) 


9.5.3.2 Interval Clock - The interval clock provides an interrupt at IPL 22 or 24 at programmed intervals. 
IPL 24 is used on the VAX-11/780, VAX-11/750, and VAX-11/730. The preferred implementation is at IPL 
22. The counter is incremented at 1 microsecond intervals, with at least .01% accuracy (8.64 seconds per 
day). The clock interface consists of three registers in the privileged register space: 


interval count 


(read only) 
interval count register (ICR) 


next interval count 


(write only) 
next interval (NICR) 
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3 
1 


8765 4 3 1 0 


oO W 


Q = 


WR W W R 
C WOO 


Interval Clock Control/Status (ICCS) 


e Interval Count - The interval register is a read only register incremented once every microsecond. 
Upon a carry out (overflow) from bit 31, it is automatically loaded from NICR and an interrupt 
is generated if the interrupt is enabled. 


e Next Interval Count - The reload register is a write only register that holds the value to be 
loaded into ICR when it overflows. The value is retained when ICR is loaded. NICR is capable 
of being loaded regardless of the current values of ICR and ICCS. 


e Interval Clock Control Status (ICCS) - The ICCS register contains control and status information 


for the interval clock. 


RUN <0> When set, ICR increments each microsecond. When clear, ICR does 
not increment automatically. At bootstrap time, run is cleared. 


XFR <4> A write only bit. Each time a 1 is written to this bit, NICR is transferred 
to ICR. 
SGL <5> A write only bit. If RUN is clear, each time this bit is set, ICR is 


incremented by one. 


IE <6> When set, an interrupt request is generated every time ICR overflows 
(INT is set). When clear, no interrupt is requested. Similarly, if INT is 
already set and the software sets IE, an interrupt is generated (i.e., an 
interrupt is generated whenever the function {IE AND INT} changes from 
0 to 1). 


INT <7) Set by hardware every time ICR overflows. If IE is set then an interrupt 
is also generated. An attempt to set this bit via MTPR clears INT, thereby 
reenabling the clock tick interrupt (if IE is set). 


ERR <31> Whenever ICR overflows, if INT is already set, then ERR is set. Thus, 
ERR indicates a missed clock tick. An attempt to set this bit via MTPR 
clears ERR. 


Thus, to setup the interval clock, load the negative of the desired interval into NICR. Then a MTPR 
#°X51,#ICCS will enable interrupts, reload ICR with the NICR interval and set run. Every “interval count" 
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microseconds will cause INT to be set and an interrupt to be requested. The interrupt routine should execute 
a MTPR #*XC1,#ICCS to clear the interrupt. If INT has not been cleared (i.e., the interrupt has not been 
handled) by the time of the next ICR overflow, the ERR bit will be set. 


At bootstrap time, bits <6> and <Q> of ICCS are cleared. The rest of ICCS and the contents of NICR and 
ICR are UNPREDICTABLE. 


NOTE 


MicroVAX processors are only required to implement ICCS<IE>. If this bit is set,an 
interrupt request at IPL 22 is generated once every 10 milliseconds. 


9.6 VAX-11/780 SPECIFIC REGISTERS 


Mne- 

Register Name monic Number Type Scope Init? 
Accelerator Control/Status ACCS 40 R/W CPU yes 
Accelerator Maintenance ACCR 41 R/W CPU no 
WCS Address WCSA 44 R/W CPU no 
WCS Data WCSD 45 R/W CPU yes 
SBI Fault/Status SBIFS 48 R/W CPU yes 
SBI Silo SBIS 49 R CPU no 
SBI Silo Comparator SBISC 50 R/W CPU yes 
SBI Maintenance SBIMT 51 R/W CPU yes 
SBI Error Register SBIER 52 R/W CPU yes 
SBI Timeout Address SBITA 53 R CPU = 
SBI Quadword Clear SBIQC 54 W CPU —— 


Micro Program Breakpoint MBRK 60 R/W CPU no 
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9.7 VAX-11/750 SPECIFIC REGISTERS 


Register Name 


CMI Error Register 
Console Storage Receiver Status 
Console Storage Receiver Data 


Console Storage Transmit Status 


Console Storage Transmit Data 
Translation Buffer Disable 
Cache Disable 
Machine Check Error Summary 
Cache Error 
Accelerator Control/Status 
Initialize UNIBUS 
Translation Buffer Data 


9.8 VAX-11/730 SPECIFIC REGISTERS 


Register Name 


Console 
Console 
Console 
Console 
Translation Buffer Disable 
Cache Disable 
Machine Check Error Summary 
Cache Error 
Accelerator Control/Status 


SBI 
SBI 
SBI 
SBI 
SBI 
SBI 
SBI 


Fault/Status 


Silo 


Storage 
Storage 
Storage 
Storage 


Receiver Status 
Receiver Data 
Transmit Status 
Transmit Data 


Silo Comparator 


Main 


tenance 


Error Register 
Timeout Address 
Quadword Clear 
Initialize UNIBUS 


[End of Chapter 9] 


Mne- 

monic Number 
CMIERR 23 
CSRS 28 
CSRD 29 
CSTS 30 
CSTD 31 
TBDR 36 
CADR 37 
MCESR 38 
CAER 39 
ACCS 40 
IORESET 55 
TBDATA 59 
Mne- 

monic Number 
CSRS 28 
CSRD 29 
CSTS 30 
CSTD 31 
TBDR 36 
CADR 37 
MCESR 38 
CAER 39 
ACCS 40 
SBIFS 48 
SBIS 49 
SBISC 50 
SBIMT 51 
SBIER 52 
SBITA 53 
SBIQC 54 
IORESET 55 


Scope 


CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
CPU 
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Init? 


yes 


yes 


MBZ 


MBZ 
yes 


CHAPTER 10 


PDP-11 COMPATIBILITY MODE 


10.1 INTRODUCTION 


NOTE 


Implementation of PDP-11 compatibility mode is optional. VAX processors that 
implement compatibility mode conform to the specification in this chapter. 


VAX compatibility mode hardware, in conjunction with a compatibility mode software executive (which runs 
in VAX mode), can emulate the environment provided to user programs on a PDP-11. This environment 
excludes the following features of normal PDP-11 operation: 


Privileged instructions such as HALT and RESET. 

Special instructions such as traps and WAIT. 

Access to internal processor registers (e.g., PSW and console switch register). 
Direct access to trap and interrupt vectors. 

Direct access to I/O devices. 

Interrupt servicing. 

Stack overflow protection. 

Alternate general register sets. 


Any processor mode other than user (i.e., Kernel and Supervisor modes are not supported) 
and separate | and D spaces. 


Floating point instructions. 


This specification is based on the behavior of all POP-11 implementations. Compatibility mode behavior is 
defined as UNPREDICTABLE where there is a difference between any two PDP-11 implementations. 
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10.2 COMPATIBILITY MODE USER ENVIRONMENT 


10.2.1 General Registers And Addressing Modes 

All of the PDP-11 general registers and addressing modes are provided in compatibility mode. Side effects 
caused by a destination address calculation have no effect on source values (except in JSR), and 
auto-increment modes in JMP and JSR do not affect the new PC. However, side effects caused by a source 
address calculation affect the value of a register used for destination address calculation. All PDP-11 


addresses are 16 bits wide. In compatibility mode, a 16-bit PDP-11 address is zero-extended to 32 bits. For 
a detailed description of PDP-11 addressing modes, refer to the PDP-11 Architecture Handbook. 


10.2.2 The Stack 
General register R6 is used as the stack pointer by certain instructions, as in the PDP-11. It is not, however, 


used by the hardware for any exceptions or interrupts. There is also no stack overflow protection in 
compatibility mode. 


10.2.3 Processor Status Word 


PDP-11 compatibility mode uses a subset of the full PDP-11 Processor Status Word. The format of the 
compatibility mode PSW is: 


1 
5 543210 


pt Palaiz}vfe 


When an RTI or RTT instruction is executed, bits 15 through 5 in the saved PSW on the stack are ignored. 


10.2.4 Instructions 


Table 10.1 lists the instructions provided in compatibility mode. 
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Compatibility Mode Instructions 


Opcode 


(octal) 


000002 
000006 
0001DD 
00020R 


TABLE 10.1 


000240-000277 


0003DD 


000400-003777 
100000-103777 


004RDD 
.050DD 
~O051DD 
.052DD 
.053DD 
.054DD 
.055DD 
.056DD 
~057SS 
.060DD 
.061DD 
.062DD 
.063DD 
0065SS 
0066DD 
1065SS 
1066DD 
0067DD 
070RSS 
O071RSS 
072RSS 
073RSS 
074RDD 
077RNN 
- LSSDD 
-2SSSS 
.3SSSS 
~ 4SSDD 
- 9SSDD 
O6SSDD 
1L6SSDD 


register specifier 
source operand specifier 
destination operand specifier 
= 0 for word operations and 1 for byte operations 


Mnemonic 


Condition codes 


SWAB 


Branches 
Branches 


JSR 
CLR(B) 
COM(B) 
INC(B) 
DEC(B) 
NEG (B) 
ADC (B) 
SBC(B) 
TST(B) 
ROR(B) 
ROL (B) 
ASR(B) 
ASL(B) 
MFPI 
MTPI 
MFPD 
MTPD 
SXT 
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Table 10.2 lists the trap instructions that cause the machine to fault to VAX mode, where either the complete 
trap may be serviced, or where the instruction may be simulated. 


TABLE 10.2 Compatibility Mode Trap Instructions 


Opcode Mnemonic 
(octal) 

000003 BPT 
000004 IOT 


104000-104377 EMT 
104400-104777 TRAP 


The instructions listed in Table 10.3 and all other opcodes not listed in Tables 10.1 or 10.2 are considered 
reserved instructions in compatibility mode, and fault to VAX mode. 


TABLE 10.3 Compatibility Mode Reserved Instructions 


Opcode Mnemonic 

(octal) 

000000 HALT 

000001 WAIT 

000005 RESET 

000007 MFPT 

00023N SPL 

OO64NN MARK 

0070DD CSM 

07500R FADD--FIS 

07501R FSUB--FIS 

07502R FMUL--FIS 

07503R FDIV--FIS 

076XXX Extended Instructions 
1064SS MTPS 

1067DD MFPS 

17XXXX FP11 Floating Point 


Note that no floating point instructions are included in compatibility mode. 


Detailed specifications of PDP-11 instructions can be found in the PDP-11 Architecture Handbook. 


10.3 ENTERING AND LEAVING COMPATIBILITY MODE 


Compatibility mode is entered by executing an REl instruction with the compatibility mode bit set in the 
target PSL on the stack. Other bits in the PSL have the following effects: 
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Bits Effect 

NZVC Condition Codes 

J T Bit 

DV Reserved operand fault if not zero 
FU Reserved operand fault if not zero 
IV Reserved operand fault if not zero 
IPL Reserved operand fault if not zero 
PRV MOD Reserved operand fault if not 3 
CUR MOD Reserved operand fault if not 3 

Is Reserved operand fault if not zero 
FPD Reserved operand fault if not zero 
TP T pending bit. See Section on T bit 


operation in compatibility mode for a 
complete description of how trace faults 
work in compatibility mode. 


VAX native mode is re-entered from compatibility mode by the compatibility mode program causing an 
exception, or by an interrupt. The PSL pushed on the kernel or interrupt stack when leaving compatibility 
mode has all the bits that cause reserved operand faults in the above table set to the appropriate state. 


Note that when an RTI or RTT instruction is executed in compatibility mode, the 11 high bits of the PSW 
are ignored, but when the PSW is restored as part of the PSL when going from VAX native mode to 
compatibility mode, those bits must be zero, or a reserved operand fault occurs. 


10.3.1 General Register Usage 


Compatibility mode registers RO through R6 are bits 15 through 0 of VAX general registers RO through Ré6, 
respectively. Compatibility mode register R7 (PC) is bits 15 through O of VAX general register R15 (PC). 
VAX registers R8 through R14 (SP) are not affected by compatibility mode. When entering compatibility 
mode, VAX register R7 and the upper halves of registers RO through R6 and R15 are ignored. When an 
exception or interrupt occurs from compatibility mode, VAX register R7 is UNPREDICTABLE and the upper 
halves of RO through Ré6 are either cleared or left unchanged. and the upper half of the stacked R15 (PC) 
is zero. Since there are no FP11 floating point instructions in compatibility mode, there are no floating 
accumulators. 


10.4 COMPATIBILITY MODE MEMORY MANAGEMENT 


PDP-11 addresses are 16-bit byte addresses, hence compatibility mode programs are confined to execute 
in the first 64k bytes of the per process part of the virtual address space. There is a one-to-one correspondence 
between a compatibility mode virtual address and its VAX counterpart (e.g., virtual address 0 references 
the same location in both modes). A compatibility mode address is interpreted as follows: 
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31 16 15 9 8 0 


PDP-11 segments can consist of 1 to 128 blocks of 64 bytes. VAX pages are 512 bytes long. The PDP-11 
capability of providing different access protection to different segments is provided in 8 block chunks since 
protection is specified at the page level in the VAX architecture. 


The memory management system protects and relocates compatibility mode addresses in the normal native 
mode manner. Thus, all of the memory management mechanisms available in VAX mode are available to 
the compatibility mode executive for managing both the virtual and physical memory of compatibility mode 
programs. All of the exception conditions that can be caused by memory management in VAX mode can 
also occur when relocating a compatibility mode address. See Chapter 5. 


10.5 COMPATIBILITY MODE EXCEPTIONS AND INTERRUPTS 

All interrupts and exception conditions that occur while the machine is in compatibility mode cause the 
machine to enter VAX mode, and are serviced as indicated in Chapter 6 (note that this includes backing 
up instruction side effects if necessary). The exception conditions discussed in this section are specific to 
compatibility mode. All these exceptions create a 3-longword frame on the kernel stack containing PSL, PC, 
and one longword of exception specific information. Bits 15 through O of this longword contain a code 


indicating the specific type of exception and bits 31 through 16 are zero. There are no compatibility mode 
exception conditions that result in traps (see Chapter 6 for definition of trap, fault, and abort). 


10.5.1 Reserved Instruction Fault 


A reserved instruction fault occurs for opcodes that are defined as reserved in compatibility mode (see 
section on Instructions). The code for the reserved instruction fault is 0. 


10.5.2 BPT Instruction Fault 


The code for the BPT instruction fault is 1. 


10.5.3 lIOT Instruction Fault 


The code for the IOT instruction fault is 2. 
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10.5.4 EMT Instruction Fault 


The fault code for the group of EMT instructions is 3. 


10.5.5 TRAP Instruction Fault 


The fault code for the group of TRAP instructions is 4. 


10.5.6 Illegal Instruction Fault 


In compatibility mode,JMP and JSR instructions with a register destination are illegal. The fault code for 
illegal instructions is 5. 


10.5.7 Odd Address Error Abort 


An odd address error abort is caused in compatibility mode whenever a word reference is attempted on a 
byte boundary. The code for odd address errors is 6. 


10.6 T BIT OPERATION IN COMPATIBILITY MODE 


In compatibility mode, a trace fault occurs at the beginning of an instruction when the T bit is set in the 
PSW at the beginning of the prior instruction. This effect is achieved by using the TP bit in the PSL (see 
Chapter 6). On trace faults, a 2-longword kernel stack frame is created, containing PSL and PC. IPL and 
IS are zero and CM is one in the stacked PSL. Compatibility mode trace fault uses the same vector as 
VAX mode trace fault. See Chapter 6. The rules for trace fault generation in compatibility mode are identical 
to those for native mode. However, an odd address abort for an instruction fetch may precede the trace 
fault for that instruction. 


There are two ways to get the T bit set at the beginning of a compatibility mode instruction: 


e An RTT/RTI instruction is executed in compatibility mode with the T bit is set in the PSW 
image on the stack. In this case, the next instruction is executed (the one pointed to by the 
PC on the stack), and a trace fault is taken before the following instruction. 


e An REI instruction is executed in VAX mode which has both the T bit and CM bit set (and 
TP clear) in the saved PSL image on the stack. Again, one instruction is executed, and the 
trace fault is taken. (For a complete description of the interaction of REI, T bit, and TP bit, 
see Chapter 6. The operations that occur as a function of these conditions are the same 
whether or not compatibility mode is being entered from the REI.) 


The T bit interacts with other compatibility mode operations as follows (for interaction with other than 
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compatibility mode specific operations, see Chapter 6): 


e T bit set (but TP is clear) at the beginning of any compatibility mode instruction which does 
not cause a compatibility mode fault. 


In this case, the instruction sets TP and executes. A trace fault is taken before the next 
instruction. The saved PSL has the T bit set and TP clear. The compatibility mode executive 
can take one of the following courses of action: 


1. If it services the exception directly, it can clear the T bit in the saved PSL on the kernel 
stack if it no longer wants to trace the program, or it can leave it set if it wants to 
continue tracing the program. It exits with an REl. 


2. If it returns the trace exception to compatibility mode, it pushes a (16-bit) PC and (16-bit) 
PSW with the T bit set on the compatibility mode User stack to simulate the effect of 
the PDP-11 trace trap. It then clears the T bit in the saved PSL image on the kernel 
stack, changes the saved PC to point to the compatibility mode service routine, and 
does an REI. The compatibility mode service routine can then clear the T bit in the 
PSW image on its stack if it does not want to continue tracing. The compatibility mode 
routine returns with RTT or RTI. 


e T bit set (but TP is clear) at the beginning of an RTI or RTT. 
The RTT/RTI instruction executes and TP is set. A trace fault occurs before the next instruction is executed. 
There are two different cases, depending on whether or not the T bit was set in the image of the PSW 
which was popped from the stack by the RTT/RTI instruction: 
1: T bit not set. Neither TP nor T will be set in the saved PSL on the kernel stack. 
2. T bit set. TP will not be set, and T will be set, as is the case as for other compatibility 


mode instructions. 


e T bit set (but TP is clear) at the beginning of any instruction which causes a compatibility 
mode fault. The fault condition is serviced first. TP is clear and T is set in the saved PSL 
pushed on the kernel stack. 


10.7 UNIMPLEMENTED PDP-11 TRAPS 
Several traps that occur in PDP-11s are not implemented in compatibility mode: 
e There is no stack overflow trap. This is equivalent to the User Mode of the KT11, where there 
is also no overflow protection. Stack overflow can be provided by the compatibility mode 


executive using the memory management mechanisms. 


e There is no concept of a double error trap in compatibility mode, since the first error always 
puts the machine in VAX mode. 
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e All other exception conditions such as power failure, memory parity, and memory management 
exceptions cause the machine to enter VAX mode. 


10.8 COMPATIBILITY MODE I/O REFERENCES 


Neither instruction stream references nor data reads nor writes can be to I/O space. The results are 
UNPREDICTABLE if I/O space is referenced from compatibility mode. 


10.9 PROCESSOR REGISTERS 


The only processor register available in compatibility mode is part of the PSW, and it maybe explicitly 
referenced only with the condition code instructions, RTI, and RTT. Access to all other registers must be 
done in VAX mode. 


10.10 PROGRAM SYNCHRONIZATION 


All PDP-11s guarantee that read-modify-write operations to I/O device registers are interlocked; that is, the 
device can determine at the time of the read that the same register will be written as the next bus cycle. 
This synchronization also works in memory on most PDP-11s. In compatibility mode, instructions that have 
modify destinations will perform this synchronization for UNIBUS I/O device registers and never for memory. 


Compatibility mode procedures can write data which is to be subsequently executed as an instruction without 
requiring any additional synchronization. 


[End of Chapter 10] 
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CHAPTER 11 


SYSTEM BOOTSTRAPPING AND CONSOLE 


11.1 INTRODUCTION 


A VAX processor can be in one of five major states; running, halted, powered off, attempting to restart the 
operating system, or attempting to load and start (bootstrap) the operating system. This chapter describes 
the processor when it is not running, and describes the transitions between major states. 


11.1.1 Major System States 


When the processor is running, it interprets instructions, services interrupts and exceptions, and initiates I/O 
operations. The console acts like a normal operating system terminal (the console is in program I/O mode). 


When the processor is halted, it does not interpret instructions, service interrupts or exceptions, or initiate 
I/O operations. The console interprets a command language which provides control over the system (the 
console is in console 1/O mode). 


When system power supplies are unable to provide power to the processor, the processor halts, and is 
powered off. 


The console can restart a halted operating system. To do so, the console searches system memory for the 
Restart Parameter Block (RPB), a data structure constructed for this purpose by the operating system. If a 
valid RPB is found, the console restarts the operating system at an address specified in the RPB. 


The console can also load and start (bootstrap) an operating system. To do so, the console searches for 
a section of correctly functioning system memory large enough to hold a primary bootstrap program (called 
VMB). If a section of memory is found, the console loads and starts VMB. VMB loads and starts the 
operating system. 


11.2 SYSTEM BOOTSTRAPPING 


System bootstrap can occur as the result of the operator entering a BOOT command at the console, or as 
the result of powerfail recovery, or of a processor halt. See the section on Major System State Transitions, 
for a complete description. 
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To prevent a situation from occurring in which the console repeatedly tries and fails to bootstrap or restart 
the operating system, the console maintains two flags, called the "bootstrap in progress" flag and the "restart 
in progress" flag. If a system bootstrap or restart would occur automatically but the corresponding flag is 
already set, the console assumes that an attempt has already been made and has failed, so the console 
does not try again. 


The console uses this algorithm to bootstrap the operating system: 


e If this bootstrap is the result of a console BOOT command, skip to step 4. 

e Print the message "Attempting system bootstrap." on the console terminal. 

° Check to see if the "bootstrap in progress" flag is set. If so, boot fails. 

e Set the bootstrap in progress flag. 

e Locate a page-aligned 64 kilobyte block of good memory. Testing memory leaves the contents 


of memory UNPREDICTABLE. If such a block cannot be found, boot fails. 


e Load a bootstrap program into that good memory, starting 512 bytes from the beginning. The 
name of the bootstrap program is VMB.EXE. If VMB cannot be found on the load device, or 
if there is an error during loading, boot fails. 


° Load the general registers: 

RO 

Rl Together, RO through R3 specify a boot device. 

R2 They are interpreted by VMB. 

R3 

R4 Reserved for future use. 

R5 Boot control parameter. Contains the value specified 
by the BOOT command, if any. Otherwise, zero. 

R6 Reserved for future use. 

R7 Reserved for future use. 

R8 Reserved for future use. 

RI Reserved for future use. 


R10 The halt PC. 

R11 The halt PSL. 

AP The halt code. 

FP Reserved for future use. 

SP The address of 512 bytes past the start of 
good memory. 


° Start VMB at the address in SP. VMB loads and starts the operating system. 


If bootstrap fails, the console prints a message reporting the failure. The message may explain the cause 
of the failure, or it may just report "System bootstrap failed." 


If the bootstrap is successful, the operating system sends a message to the console, causing the console 
to clear the bootstrap in progress flag. See the section on System Running, for a description of the messages 
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the operating system can pass to the console. 


11.3 SYSTEM RESTART 


The console can restart a halted operating system. To do so, the console searches system memory for the 
Restart Parameter Block (RPB), a data structure constructed for this purpose by the operating system. If a 
valid RPB is found, the console restarts the operating system at an address specified in the RPB. 


The console keeps an internal flag called "restart in progress", which it uses to avoid repeated attempts to 
restart a failing operating system. An additional “restart in progress" flag may be maintained by software in 
the RPB. 


A system restart can occur as the result of a powerfail restart, or as the result of a processor halt. See 
the section on Major System State Transitions, for a complete description. 


The console uses this algorithm to restart the operating system: 


e Print the message "Attempting system restart." on the console terminal. 

e Check to see if the internal "restart in progress" flag is set. If so, restart fails. 

e Set the internal restart in progress flag. 

e Check to see if memory has been preserved by battery backup. If not, restart fails. 

e Look for a Restart Parameter Block (RPB), left in memory by the operating system. If none 


is found, restart fails. 


e Read the software restart in progress flag from bit<O> of the fourth longword of the RPB. If 
it is set; restart fails. 


° Load SP with the address of the RPB plus 512. 
e Load AP with the halt code. 
e Start the processor at the restart address, which is read from the second longword in the 
RPB. 
If restart fails, the console prints a message reporting the failure. The message may explain the cause of 
the failure, or it may just report "System restart failed." 
If the restart is successful, the operating system sends a message to the console, causing the console to 


clear its internal restart in progress flag. See the section on System Running, for a description of the 
messages the operating system can pass to the console. 
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The Restart Parameter Block is a page aligned control block, created by the operating system. Its format 
is this: 


physical address of the RPB >RPB 
physical address of the restart routine 
checksum of the first 31 longwords of the restart routine 
software restart in progress flag (bit 0) 
Restart Parameter Block 
(RPB) 
The console uses this algorithm to find a Restart Parameter Block: 
e Search for a page of memory that contains its address in the first longword. If none is found, 
the search for an RPB has failed. 
° Read the second longword in the page (the physical address of the restart routine). If it is 


not a valid physical address, or if it is zero, return to step 1. The check for zero is necessary 
to ensure that a page of zeros does not pass the test for a valid RPB. 


e Calculate the 32 bit twos-complement sum (ignoring overflows) of the first 31 longwords of the 
restart routine. If the sum does not match the third longword of the RPB, return to step 1. 


e A valid RPB has been found. 


11.4 SYSTEM POWER FAIL AND RECOVERY 


The system requires power to operate. The system power supply conditions external power and transforms 
it for use by the processor. When external power fails, the power supply requests a power fail interrupt of 
the processor, but continues to provide power to the processor for at least 2 milliseconds after the interrupt 
is requested, to allow the operating system to save state. When the power supply can no longer provide 
power to the processor, the processor is halted and powered off. Battery backup options are available on 
some processors to supply power after external power fails, to maintain the contents of main memory, and 
to keep system time with the time of day clock. 


When power is restored, the console initializes itself, initializes the processor, and examines the front panel 
“console lock" and “halt action" switches. If the console is locked, it attempts a system restart, and if that 


fails, a system bootstrap. If the console is not locked, its action is determined by the setting of the halt 
action switch. 


Note that when the processor loses power, its state is lost. For example, if a processor is halted when 
power fails, the console powerup action is still determined by the front panel switches, so the system does 
not necessarily stay halted on powerup. 
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11.4.1 Hardware Initialization 

There are three kinds of hardware initialization, called processor initialization, system bus initialization, and 
powerup initialization. Processor initialization is the result of a console INITIALIZE, and involves the initialization 
of registers internal to the processor and the console. System bus initialization is the result of a console 
UNJAM command, and is implementation dependent. Powerup initialization affects the system as a whole. 
It is the result of the restoration of power, and includes a processor initialization. 


The processor must be initialized after an error halt. If the processor starts running after an error halt, 
without an intervening processor initialization, the operation of the processor is UNDEFINED. 


The following processor registers are affected by a processor initialization. Registers not listed here are 
UNPREDICTABLE after a processor initialization. 


° PSL - 041F0000 (hex). 

° IPL - 1F (hex). 

° ASTLVL - 4. 

° SISR - 0. 

e ICCS - <6> and <0O> clear, the rest is UNPREDICTABLE. 
° RXCS - 0. 

°  TXCS - 80 (hex). 


° MAPEN - 0. 


e PME - 0. 

e ACCS - 0 if no accelerator; 8001 (hex) if floating point accelerator. 

e cache - empty or valid. 

e instruction buffer - empty or valid. 

e console previous reference - physical address, longword size, address 0. 


° KSP, ESP, SSP, USP, ISP - UNPREDICTABLE. 
° POBR, POLR, P1BR, P1LR - UNPREDICTABLE. 
e SBR, SLR - UNPREDICTABLE. 


e PCBB - UNPREDICTABLE. 
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e SCBB - UNPREDICTABLE. 
e translation buffer - UNPREDICTABLE. 
e NICR, ICR - UNPREDICTABLE. 


@ TODR - unaffected. 


e main memory - unaffected. 

e general registers RO through PC - unaffected. 
° halt code - unaffected. 

e bootstrap in progress flag - unaffected. 

° internal restart in progress flag - unaffected. 


In addition to what processor initialization does, powerup initializes the following: 
e bootstrap in progress flag - cleared. 
e internal restart in progress flag - cleared. 
e halt code - 03 (powerup). 
e general registers - UNPREDICTABLE. 
° system memory - unaffected if preserved by battery backup, otherwise, UNPREDICTABLE. 


e TODR - unaffected if preserved by battery backup, otherwise, 0. 


11.5 MAJOR SYSTEM STATE TRANSITIONS 


The transitions between major system states are determined by the current state and by a number of 
variables and events, including: 


° whether power is available to the system 
e the console front panel halt action switch 
e the console lock switch 

° the bootstrap in progress flag 

e the restart in progress flag 


e processor error halts 
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e the HALT instruction 


e console commands 


TABLE 11-1 


Major System State Transitions 


RESULTING STATE 


PREVIOUS 
STATE Powered Off Halted Booting Restarting Running 


Powered A and power | B and power | C and power can’t 
Off restored restored restored happen 
Halted power fails BOOT command can’t 
and unlocked CONTINUE 
happen and unlocked 
Booting | power fails can’t boot 
or D happen succeeds 
Restart | power fails restart restart 
fails succeeds 
Running | power fails jA & processor|B & processor|C & processor 
halts, or D halts halts 


e A - the console is unlocked and the halt action switch is set to "halt". 


e B - the console is unlocked and the halt action switch Is set to "boot". 

e C - the console is unlocked and the halt action switch is set to "restart", or the console is 
locked. 

° D - the console is unlocked and the operator types control-P and HALT. 


These are the rules describing the transitions: 
° When power is not available to the processor, the processor is powered off. 


e If the console is not locked when power is restored or when the processor halts, enter the 
state selected by the console front panel halt action switch. 


e If the console is locked when power is restored or when the processor halts, attempt a system 
restart. 
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° When system restart fails, attempt a system bootstrap. 

e When system bootstrap fails, halt. 

° When system bootstrap or system restart succeed, the processor starts running. 

e When the processor is halted and the console is not locked, the console BOOT command 


causes a system bootstrap. 


e When the processor is halted and the console is not locked, the console START and CONTINUE 
commands cause the processor to start running. 


e If the console is not locked, and is running or booting or restarting, typing control-P followed 
by a HALT command at the console halts the processor. 


Table 11-1 shows the actions that cause major system state transitions. 


11.6 SYSTEM HALTED (CONSOLE I/O MODE) 


Traditionally, computers have had a panel of lights and switches on the front for machine diagnosis and 
for operation of stand-alone programs. On VAX, this functionality is provided by an "ASCII console" through 
which the operator controls the machine. The ASCII console may be envisioned as a virtual console processor 
attached to the main processor, to a console terminal, and to a console file storage device. Note that the 
console processor need not be physically separate from the main processor. It may be implemented in main 
processor microcode, as in the VAX-11/750. The console processor interprets commands typed on the 
console terminal, and controls the operation of the main processor. 


Through the console terminal, an operator can boot the operating system, a field service engineer can 
maintain the system, and a system user can communicate with running programs. Although it is recognized 
that sophisticated users may use the console for developing software, this is not a goal for console 
implementations. 


The processor can halt as the result of an operator command, or a serious system error, or a HALT 
instruction, or powerfail recovery. See the section on Major System State Transitions for a complete 
description. 


When the processor is halted, the operator controls the system through the console command language. 
The console is in "console I/O mode". The console prompts the operator for input with the string ">>>". 


It may be possible for the operator to put the system in an inconsistent state through the use of the console 
commands. For example, it may be possible to use the console to set bits in MBZ fields, or to set conflicting 
control bits. The operation of the processor in such a state is UNDEFINED. 


Control characters are typed by pressing the character key while simultaneously holding down the control 
key. If an unrecognized control character is typed (a control character here means a character with an 
ASCII code less than 32 decimal) it is echoed as up arrow followed by the character with ASCII code 64 
greater. For example, BEL (ASCII code 7) is echoed as "*G", since capital G is ASCII code 7+64=71. 
When a control character is deleted with rubout, it is echoed the same way. After echoing the control 
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character, the console processes it like a normal character. Unless the control character is part of a comment, 
the command will be invalid, and the console will respond with an error message. 


The response of the console to characters with codes greater than 127 (decimal) is UNPREDICTABLE. 


11.6.1 Console Command Syntax 


The console accepts commands of lengths up to 80 characters. Longer commands are responded to with 
an error message. 


Commands may be abbreviated. Abbreviations are formed by dropping characters from the end of a keyword. 
All commands but SET may be unambiguously abbreviated to one character. SET cannot be abbreviated 
to less than two characters, since it then conflicts with START. The console verifies all characters typed in 
a command, even when they are not needed to uniquely identify the command. 


Multiple adjacent spaces and tabs are treated as a single space by the console. Leading and trailing spaces 
and tabs are ignored. 


Command qualifiers can appear after the command keyword, or after any symbol or number in the command. 
All numbers (addresses, data, counts) are in hexadecimal. (Note, though, that symbolic register names include 


decimal digits.) Hex digits are 0 through 9, and A through F. The console does not distinguish between 
upper and lower case either in numbers or in commands. Both are accepted. 


11.6.2 Console Command Keywords 
Processor control commands: 

° INITIALIZE 

° START <address> 

° CONTINUE 

° HALT 

° BOOT <device> 

° NEXT <count> 

e MICROSTEP <count> 


: UNJAM 


Data transfer commands: 
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e EXAMINE <address> 
e DEPOSIT <address> <data> 
® LOAD <file> 


@ X <address> <count> 


Console control commands: 
e FIND 
® REPEAT <command> 


° SET <parameter> <value> 


® TEST 
® @ <file> 
e ! <comment> 


11.6.3 Console Commands 


11.6.3.1 BOOT - 
BOOT [<qualifier list>] [<device>] 


The device specification is of the format ‘ddan’, where ‘dd’ is a two letter device mnemonic, ’a’ is an 
optional one digit adapter number, and ’n’ is a one digit unit number. 


The console initializes the processor and starts VMB running. (See the section on System Bootstrapping.) 
VMB boots the operating system from the specified device. The default device is implementation dependent. 


Qualifiers: 
° /R5:<data> - After initializing the processor and before starting VMB, R5 is loaded with the 


specified data. This allows a command file containing a BOOT command or a console user 
to pass a parameter to VMB. 


11.6.3.2 CONTINUE - 
CONTINUE 


The processor begins instruction execution at the address currently contained in the program counter. 
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Processor initialization is not performed. The console enters program I/O mode. 


11.6.3.3 DEPOSIT - 
DEPOSIT [<qualifier list>] <address> <data> 


Deposits the data into the address specified. If no address space or data size qualifiers are specified, the 
defaults are the last address space and data size used in a DEPOSIT or EXAMINE command. After processor 
initialization, the default address space is physical memory, the default data size is long, and the default 
address is zero. 


If the specified data is too large to fit in the data size to be deposited, the console ignores the command 
and issues an error response. If the specified data is smaller that the data size to be deposited, it is 
extended on the left with zeros. 


The address may also be one of the following symbolic addresses: 


e PSL - the processer status longword. No address space qualifier is legal. When PSL is 
examined, the address space is identified as "M" (machine dependent). 


e PC - the program counter (general register 15). The address space is set to /G. 
e SP - the stack pointer (general register 14). The address space is /G. 


° Rn - general register ’n’. The register number is in decimal. The address space is /G. For 
example: 


D R5 1234 is equivalent to D/G 5 1234 
D R10 6FFOO is equivalent to D/G A 6FFOO 


e *4+’ - the location immediately following the last location referenced in an examine or deposit. 
For references to physical or virtual memory spaces, the location referenced is the last address, 
plus the size of the last reference (1 for byte, 2 for word, 4 for long). For other address 
spaces, the address is the last addressed referenced, plus one. 


e ’.’ - the location immediately preceding the last location referenced in an examine or deposit. 
For references to physical or virtual memory spaces, the location referenced is the last address 
minus the size of this reference (1 for byte, 2 for word, 4 for long). For other address spaces, 
the address is the last addressed referenced minus one. 


e **’ . the location last referenced in an examine or deposit. 
e ’@’ - the location addressed by the last location referenced in an examine or deposit. 
Qualifiers: 


e /B - The data size is byte. 
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IW - The data size is word. 

/L - The data size is longword. 

/V - The address space is virtual memory. All access and protection checking occur. If the 
access would not be allowed to a program running with the current PSL, the console issues 
an error message. This includes refusing odd address references if PSL<CMD> is set. Virtual 
space DEPOSITs cause the PTE<M> bit to be set. If memory mapping is not enabled, virtual 
addresses are equal to physical addresses. 


/P - The address space is physical memory. 


/| - The address space is internal processor registers. These are the registers addressed by 
the MTPR and MFPR instructions. 


/G - The address space is the general register set, RO through PC. 

/M - (Optional) The address space is machine dependent. 

/C - The address space is microcode memory. 

/U - (Optional) The address space is console microprocessor memory. 

/N:<count> - The address is the first of a range. The console deposits to the first address, 
then to the specified number of succeeding addresses. Even if the address is the symbolic 
address "-", the succeeding addresses are at larger addresses. The symbolic address specifies 


only the starting address, not the direction of succession. For repeated references to preceeding 
addresses, use "REPEAT DEPOSIT - <data>". 


For example: 

D/P/B/N: 1FF 0 0 Clears the first 512 bytes of physical memory. 
D/V/L/N:3 1234 5 Deposits "5" into 4 longwords in virtual memory. 
D/N:8 RO FFFFFFFF Loads general registers RO through R8. 

D/N:200 —- 0 Clears the previous address, then the next 512. 

If conflicting address space or data sizes are specified, the console ignores the command and issues an 


error response. 


11.6.3.4 EXAMINE - 


EXAMINE [<qualifier list>] [<address>] 


Examines the contents of the specified address. If no address is specified, "+" is assumed. The address 


may also be 


one of the symbolic addresses described under DEPOSIT. 
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Qualifiers: 

The same qualifiers may be used on EXAMINE as may be used on DEPOSIT. 
RESPONSE: <tab><address space identifier> <address> <data> 

The address space identifier can be: 


e P - physical memory. Note that when virtual memory is examined, the address space and 
address in the response are the translated physical address. 


° G - general register. 
° | - internal processor register. 
e M - machine dependent address space. When the PSL is examined, the address space identified 


is machine dependent. 


° C - microcode memory. 
e U - (Optional) console microprocessor memory. 
11.6.3.5 FIND - 


FIND [<qualifier list>] 
The console searches main memory starting at address zero for a page-aligned 64 kilobyte block of good 
memory, or a restart parameter block (RPB). If the block is found, its address plus 512 is left in SP. If the 
block is not found, an error message is issued, and the contents of SP are UNPREDICTABLE. If no qualifier 
is specified, /RPB is assumed. 
Qualifiers: 
e IMEMORY - search memory for a page aligned block of good memory, 64 kilobytes in length. 
Since the search may include a read/write test of memory, the search leaves the contents of 
memory UNPREDICTABLE. 


e /RPB - search memory for a restart parameter block. See the section on System Restart, for 
the search algorithm. The search leaves the contents of memory unchanged. 


11.6.3.6 INITIALIZE - 
INITIALIZE 


A processor initialization is performed. See the section on Powerfail and Recovery, for initial register contents. 
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HALT 
The processor stops execution of macroinstructions, after completing the current macroinstruction. Neither 
processor initialization nor |/O initialization occurs, so I/O operations already in progress are unaffected. If 
the processor is already halted, the HALT command has no affect. 
NOTE 
On the 11/750 and 11/730, the processor is halted whenever the console is in 
console I/O mode; the HALT command does not affect the processor. On the 11/780, 
it is possible for the console to be in console I/O mode when the processor is 
running. The HALT command causes the 11/780 console to halt the 11/780 processor. 
RESPONSE: PC = <PC> 


lf the processor is already halted, the response is preceded by a halt message. 


MESSAGE: Already halted 


11.6.3.8 LOAD - 
LOAD [<qualifier list>] <file> 
The console loads data from the specified file into memory. If no qualifiers are specified, data is loaded 
into physical memory, starting at address 0. If an unrecoverable device or memory error occurs during the 
load, the command is aborted, and the console issues an error message. 
QUALIFIERS: 

° /S:<address> - the data is loaded starting at the specified address. 


e /C - the data is to be loaded into microcode memory. 


e /U - (optional) the data is to be loaded into console microprocessor memory. 


11.6.3.9 MICROSTEP - 
MICROSTEP [<count>] 
The console causes the processor to execute the specified number of microinstructions. If no count is 


specified, 1 is assumed. After the last microinstruction is executed, the console enters “space bar step 
mode." 
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In space bar step mode, the console executes one microinstruction each time the operator presses the 
space bar. If the operator presses any other key, the console exits space bar step mode, then processes 
the character typed. Typing carriage return is the suggested means of exiting from space bar step mode. 
The operator can cause the console to finish the macroinstruction under way by use of the NEXT command. 


RESPONSE: uPC = <uPC> 


11.6.3.10 NEXT - 

NEXT [<count>] 

The console causes the processor to execute the specified number of macroinstructions. If no count is 
specified, 1 is assumed. After the last macroinstruction is executed, the console enters "space bar step 
mode." 

In space bar step mode, the console executes one macroinstruction each time the operator presses the 
space bar. If the operator presses any other key, the console exits space bar step mode, and then processes 


the character typed. Typing carriage return is the suggested means of exiting from space bar step mode. 


The NEXT command can be used to finish a macroinstruction partially executed by MICROSTEP. This partial 
execution is counted by NEXT as though it were the execution of a full instruction. 


RESPONSE: PC = <PC> 


11.6.3.11 REPEAT - 

REPEAT <command> 

The console repeatedly displays and executes the specified command. The repeating is stopped by the 
operator typing control-C. Any valid console command may be specified for the command with the exceptions 
of the REPEAT command and the @ command. If the command is REPEAT or @, the results are 
UNPREDICTABLE. 


RESPONSE: <dependent upon command specified> 


11.6.3.12 START - 
START [<qualifier list>] [<address>] 


The console starts instruction execution at the specified address. The default address is implementation 
dependent. If no qualifier is present, macroinstruction execution is started. If memory mapping is enabled, 
macroinstructions are executed from virtual memory. The START command is equivalent to a DEPOSIT to 
PC, followed by a CONTINUE. No INITIALIZE is performed. 
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QUALIFIERS: 

e /C - Micro (rather than macro) instruction execution is started. 

° /U - (Optional) console microprocessor instruction execution is started. 
11.6.3.13 SET - 


SET <parameter> <data> 


Sets the console parameter to the indicated value. The console parameters and their meanings are all 
implementation dependent. 


11.6.3.14 TEST - 
TEST [<qualifier list>] 


The console executes a self test. All qualifiers are optional. 


11.6.3.15 UNJAM - 


A system bus initialization is performed. The effects of a system bus initialization are implementation 
dependent. 


11.6.3.16 Binary Load And Unload Command - 


X [<qualifier list>] <address> <count> <CR> <checksum> 


Qualifiers: 
e /P - data is to be read from or written to physical memory. 
° /C - data is to be read from or written to microcode memory. 
e /U - (Optional) data is to be read from or written to console microprocessor memory. 


The X command is for use by automatic systems communicating with the console. It is not intended for 
use by operators. The console loads or unloads (that is, writes to memory, or reads from memory) the 
specified number of data bytes, starting at the specified address. If no qualifiers specify otherwise, data is 
transferred to or from physical memory. 
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lf bit 31 of the count is clear, data is to be received by the console, and deposited into memory. If bit 31 
of the count is set, data is to be read from memory and sent by the console. The remaining bits in the 
count are a positive number indicating the number of bytes to load or unload. 


The console accepts the command upon receiving the carriage return. The next byte the console receives 
is the command checksum, which is not echoed. The command checksum is verified by adding all command 
characters, including the checksum, (but not including the terminating carriage return or rubouts or characters 
deleted by rubout), into an 8 bit register initially set to zero. If no errors occur, the result is zero. If the 
command checksum is correct, the console responds with the input prompt and either sends data to the 
requestor or prepares to receive data. If the command checksum is in error, the console responds with an 
error message. The intent is to prevent inadvertent operator entry into a mode where the console is accepting 
characters from the keyboard as data, with no escape sequence possible. 


lf the command is a load (bit 31 of the count is clear), the console responds with the input prompt, then 
accepts the specified number of bytes of data for depositing to memory, and an additional byte of received 
data checksum. The data is verified by adding all data characters and the checksum character into an 8 
bit register initially set to zero. If the final contents of the register is non-zero, the data or checksum are 
in error, and the console responds with an error message. 


If the command is a binary unload (bit 31 of the count is set), the console responds with the input prompt, 
followed by the specified number of bytes of binary data. As each byte is sent it is added to a checksum 
register initially set to zero. At the end of the transmission, the 2’s complement of the low byte of the 
register is sent. 


If the data checksum is incorrect on a load, or if memory errors or line errors occur during the transmission 
of data, the entire transmission is completed, and then the console issues an error message. If an error 
occurs during loading, the contents of the memory being loaded are UNPREDICTABLE. 


If the console implements SET TERMINAL ECHO and SET TERMINAL NOECHO commands, the state of 
the echo flag is unaffected by the X command. Regardless of the flag, echo is suppressed during the 
receiving of the data string and checksums. 


It is possible to control the console through the use of the console control characters (control-C, control-S, 
control-O, etc.) during a binary unload. It is not possible during a binary load, as all received characters 
are valid binary data. 

Data being loaded with a binary load command must be received by the console at a rate of at least one 
byte per second. If the console does not receive a data byte for more than one second, the console aborts 
the transmission by issuing an error message and prompting for input. 

The entire command, including the checksum, may be sent to the console as a single burst of characters 


at the console’s specified character rate. To make this command useful for use in automated systems, the 
console is able to receive at least 4K bytes of data in a single ’X’ command. 


11.6.3.17 The Indirect Command - 
@ <file> 


The console reads and executes commands from the file. The commands are displayed on the console 
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terminal as they are read. When a BOOT, START, or CONTINUE command is executed, putting the console 
into program I/O mode, command file processing is suspended. If a "software done" message is received 
by the console (see the section on System Running) and the processor halts, command file processing is 
continued. If the processor halts before a software done message is received by the console, the remainder 
of the command file is ignored. 

Command files can be chained by having another @ command as the last command in a file. If an @ 
command is encountered in the middle of a command file, the console executes it, but may ignore the 


remainder of the original command file. Whether the console resumes execution of the original command 
file on completion of the secondary is an implementation option. 


11.6.3.18 The Comment - 
! <comment> 


The comment is ignored. 


11.6.4 Console Command Language Subsets 


To reduce cost, some implementations may not implement the full console functionality. A subset 
implementation is defined. 


The commands supported by a subset console are: 
e BOOT <device> 
° CONTINUE 
° DEPOSIT <address> <data> 
° EXAMINE [<address>] 
° INITIALIZE 
e HALT 
e START <address> 
° TEST 
° X <address> <count> 


e ! <comment> 


EXAMINE and DEPOSIT support the qualifiers /B/W/L/P/V/I/G, and the symbolic address PSL. 
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The control characters supported are carriage return, control-P, control-S, control-Q, control-U, and rubout. 


The subset console may perform range checking on addresses and data. If it does not, it truncates values 
that are too large, and uses the lower digits. 


The subset console may accept only abbreviated commands. It may also limit the command length to less 
than 80 characters. It may accept only uppercase commands. Automatic systems communicating with a 


console must limit themselves to the commands in the subset, must abbreviate all commands, and must 
use only uppercase, if they are to communicate with any console implementation. 


11.6.5 Console Options 


Some features are optional, such as the diagnosis mode, and the /M and /U qualifiers. These may be 
implemented by any console, even by a subset. 


11.6.6 Console Errors And Error Messages 


The console can issue error messages in response to commands. The case (upper case or lower case) is 
implementation dependent. 


The console responds to all commands within 1 second. If the processor does not respond to a console 
request, the console issues an error message within 1 second. 


These three messages indicate failure of the requested operation. Some implementations may abbreviate 
some or all of these messages to "Can't". 


° Can’t power up - the console microprocessor cannot complete its own power up initialization. 
The state of the console and that of the processor are UNDEFINED. 


° File not found - the file specified in a BOOT, LOAD, or @ command cannot be found. 
° Reference not allowed - the requested reference would violate virtual memory protection, or 


the address is not mapped, or the reference is invalid in the specified address space, or the 
value is invalid in the specified destination. 


These messages are responses to ill-formed commands. Some implementations may abbreviate some or all 
of these messages to “Illegal command". 


e Illegal command - the command string cannot be parsed. 
e Invalid digit - a number has an invalid digit. 
° Line too long - the command was too large for the console to buffer. The message is issued 


only after receipt of the terminating carriage return. 


e Illegal address - the address specified falls outside the limits of the address space. 
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e Value too big - the value specified does not fit in the destination. 

e Conflicting switches - for example, two different data sizes are specified with an EXAMINE 
command. 

e Unknown switch - the switch is unrecognized. 


e Unknown symbol - the symbolic address in an EXAMINE or DEPOSIT is unrecognized. 


This message is produced when a binary transfer command is improperly specified. 


e Incorrect checksum - the command or data checksum of an X command is incorrect. If the 
data checksum is incorrect, this message is issued, and is not abbreviated to "Illegal command’. 


This message is produced when a HALT command is given to the console and the processor is already 
halted. 

e Already halted - the operator entered a HALT command and the processor was already halted. 
Some console commands may result in errors. For example, if a memory error occurs as the result of a 
console command, the console will respond with an error message. Such errors do not affect the halted 


program. Specifically, the processor stays halted, and if it is started later, no exception or interrupt occurs 
as the result of the console error. 


11.6.7 Halts And Halt Messages 
Whenever the processor halts, the console prints the response "PC = "<PC>. Except when the halt was 
requested by a console HALT command or by a NEXT command, the response is preceded by a halt 
message. For example: 
206 HALT executed 

PC = 800050D3 


The number preceeding the halt message is the halt code, and is passed to the operating system ona 
restart. Halt code 03 does not have a corresponding message. It is passed by the console during powerfail 
restart. 

The halt messages are: 


° 200 CPU halted - the operator entered a HALT command while the processor was running, 
so the console halted the processor. 


° 201 Microverify complete - the console quick verify completed successfully. 


e 202 CPU halted - the operator typed control-P while the console was in program I/O mode 


SYSTEM BOOTSTRAPPING AND CONSOLE Page 11-21 
System Halted (console 1/O mode) 


and the console was not locked, and the console halted the processor. 


° 03 - Halt code 03 does not appear in a halt message, but is passed by the console on 
powerfail restart. 


e 204 Interrupt stack not valid - in attempting to push state onto the interrupt stack during an 
interrupt or exception, the processor discovered that the interrupt stack was mapped NO 
ACCESS or NOT VALID. 


e 205 CPU double error - the processor attempted to report a machine check to the operating 
system, and a second machine check occurred. 


° 206 HALT executed - the processor executed a HALT instruction in kernel mode. 
e 207 Invalid SCB vector - the vector had bits<1:0> set. 


° 208 No user WCS - an SCB vector had bits <1:0> equal to 2, and no user writable control 
store was installed. 


e 209 error pending on halt - the processor was halted (by control-P) before it could perform 
an error halt. 


e ?0A CHM from interrupt stack - a change mode instruction was executed when PSL<IS> was 
set. 

° 20B CHM to interrupt stack - the exception vector for a change mode had bit<0> set. 

e ?0C SCB read error - a hard memory error occurred while the processor was trying to read 


an exception or interrupt vector. 


11.7 SYSTEM RUNNING (PROGRAM I/O MODE) 


When the processor is running, the console is in "program I/O mode" in which all terminal interaction is 
handled by the operating system. In program !/O mode, the console terminal becomes like any other 
operating system terminal, and passes all characters (except for control-P) through. If the console is locked, 
even control-P is passed through. If the console is not locked, control-P causes the processor to halt and 
the console to enter console I/O mode. 


[End of Chapter 11] 
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APPENDIX A 


INSTRUCTION SET AND OPCODE ASSIGNMENTS 


A.1 INSTRUCTION OPERAND FORMATS 


The format of the instructions is given using the qualified name convention described in the next section. 
For the mnemonics {} encloses a list of data types of which one must be selected. Instructions which have 
two forms differing in the number of operands have the number of operands appended to the opcode as 
a digit. For the operands, {} encloses all implied operands. 


Instructions 


e Add 2 Operand 7 
ADD{B,W,L,F,D,G,H}2 add.rx, sum.mx 


e Add 3 Operand 7 
ADD{B,W,L,F,D,G,H}3 add1.rx, add2.rx, sum.wx 


° Add With Carry 1 
ADWC add.rl, sum.ml 


e Add Aligned Word 1 
ADAWI add.rw, sum.mw 


e Arithmetic Shift 2 
ASH{L,Q} cnt.rb, src.rx, dst.wx 


e Add Compare and Branch 7 
ACB{B,W,L,F,D,G,H} limit.rx, add.rx, index.mx, displ.bw 
Compare is LE on positive add, GE on negative add. 


e Add One and Branch Less Than or Equal 1 
AOBLEQ limit.rl, index.ml, displ.bb 


® Add One and Branch Less Than | 
AOBLSS limit.rl, index.ml, displ.bb 


e Add Packed 4 Operand 1 
ADDP4 addlen.rw, addaddr.ab, sumlen.rw, sumaddr.ab, 
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(RO-3.wl} 


° Add Packed 6 Operand 1 
ADDP6 addilen.rw, addtaddr.ab, add2len.rw, add2addr.ab, 
sumlen.rw, sumaddr.ab, {RO-5.wi} 


e Arithmetic Shift and Round Packed 1 
ASHP cnt.rb, srclen.rw, srcaddr.ab, round.rb, dstlen.rw, 
dstaddr.ab, {RO-3.wl} 


e Bit Test 3 
BIT{B,W,L} mask.rx, src.rx 


e Bit Set 2 Operand 3 
BIS{B,W,L}2 mask.rx, dst.mx 


e Bit Set 3 Operand 3 
BIS{B,W,L}3 mask.rx, src.rx, dst.wx 


e Bit Clear 2 Operand 3 
BIC{B,W,L}2 mask.rx, dst.mx 


° Bit Clear 3 Operand 3 
BIC{B,W,L}3 mask.rx, src.rx, dst.wx 


e Conditional Branch 12 
B{condition} displ.bb 


Condition Name 
LSS Less Than 
LEQ Less Than or Equal 
EQL, EQLU Equal, Equal Unsigned 
NEQ, NEQU Not Equal, Not Equal Unsigned 
GEQ Greater Than or Equal 
GTR Greater Than 
LSSU, CS Less Than Unsigned, Carry Set 
LEQU Less Than or Equal Unsigned 
GEQU, CC Greater Than or Equal Unsigned, 
Carry Clear 
GTRU Greater Than Unsigned 
ES) Overflow Set 
VC Overflow Clear 
e Branch With {Byte, Word} Displacement 2 


BR{B,W} displ!.bx 


e Branch on Bit 2 
BB{S,C} pos.rl, base.vb, displ.bb, {field.rv} 
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Branch on Bit (and modify without interlock) 
BB{S,C}{S,C} pos.rl, base.vb, displ.bb, {field.mv} 


Branch on Bit (and modify) Interlocked 
BB{SS,CC}I pos.rl, base.vb, displ.bb, {field.mv} 


Branch on Low Bit 
BLB{S,C} src.rl, displ.bb 


Branch to Subroutine With {Byte, Word} Displacement 
BSB{B,W} displ.bx, {-(SP).wl} 


Breakpoint Fault 
BPT {-(KSP).w*} 


Bit Set PSW 
BISPSW mask.rw 


Bit Clear PSW 
BICPSW mask.rw 


Clear 
CLR{B,W,L=F,Q=D=G,0O=H} dst.wx 


Convert 
CVT{B,W,L,F,D,G,H}{B,W,L,F,D,G,H} srce.rx, dst.wy 
All pairs except BB,WW,LL,FF,DD,GG,HH,DG, and GD 


Convert Rounded 
CVTR{F,D,G,H}L sre.rx, dst.wl 


Compare 
CMP{B,W,L,F,D,G,H} src1.rx, src2.rx 


Compare Field 
CMPV pos.rl, size.rb, base.vb, {field.rv}, src.rl 


Compare Zero-Extended Field 
CMPZV pos.rl, size.rb, base.vb, {field.rv}, src.rl 


Case 
CASE{B,W,L} selector.rx, base.rx, limit.rx, displ.bw-list 


Call Procedure with General Argument List 
CALLG arglist.ab, dst.ab, {-(SP).w*} 


Call Procedure with Stack Argument List 
CALLS numarg.rl, dst.ab, {-(SP).w*} 


Compare Characters 3 Operand 
CMPC3 len.rw, srctaddr.ab, src2addr.ab, {RO-3.wl} 
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e Compare Characters 5 Operand 1 
CMPC5 srcilen.rw, srctaddr.ab, fill.rb, src2len.rw, src2addr.ab, {RO-3.wl} 


e Cyclic Redundancy Check 1 
CRC tbl.ab, inicrce.rl, strlen.rw, stream.ab, {RO-3.w]} 

° Compare Packed 3 Operand 1 
CMPP3 len.rw, srctaddr.ab, src2addr.ab, {RO-3.wl} 

° Compare Packed 4 Operand 1 
CMPP4 srcilen.rw, srctaddr.ab, src2len.rw, src2addr.ab, 
{RO-3.wl} 

e Convert Long to Packed 1 


CVTLP sre.rl, dstlen.rw, dstaddr.ab, {RO-3.wl} 


e Convert Packed to Long 1 
CVTPL srclen.rw, srcaddr.ab, {RO-3.wl}, dst.wl 


° Convert Packed to Trailing 2 
Convert Trailing to Packed 
CVT{PT,TP} srclen.rw, srcaddr.ab, tbladdr.ab, dstlen.rw, 
dstaddr.ab, {RO-3.wl} 


° Convert Packed to Leading Separate 2 
Convert Leading Separate to Packed 
CVT{PS,SP} srclen.rw, srcaddr.ab, dstlen.rw, dstaddr.ab, 
{RO-3.wl} 


e Change Mode 4 
CHM{K,E,S,U} param.rw, {-(ySP).w*} 
Illegal on interrupt stack. 
Where y=MINU(x, PSL<current_mode>) 


e Decrement 3 
DEC{B,W,L} dif.mx 


e Divide 2 Operand 7 
DIV{B,W,L,F,D,G,H}2 divr.rx, quo.mx 


e Divide 3 Operand 7 
DIV{B,W,L,F,D,G,H}3 divr.rx, divd.rx, quo.wx 


e Divide Packed 1 
DIVP divrien.rw, divraddr.ab, divdlen.rw, divdaddr.ab, 
quolen.rw, quoaddr.ab, {RO-5.wl, -16(SP):-1(SP).wb} 


e Edit Packed to Character String 1 
EDITPC srclen.rw, srcaddr.ab, pattern.ab, dstaddr.ab, 
{RO-5.wl} 
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e Extended Divide 
EDIV divr.rl, divd.rq, quo.wl, rem.wl 


e Extended Modulus 
EMOD{F,D} mulr.rx, mulrx.rb, muld.rx, int.wl, fract.wx 
EMOD{G,H} mulr.rx, mulrx.rw, muld.rx, int.wl, fract.wx 


e Extended Multiply 
EMUL mulr.ri, muld.rl, add.rl, prod.wq 


° Extract Field 
EXTV pos.rl, size.rb, base.vb, {field.rv}, dst.wl 


° Extract Zero-Extended Field 
EXTZV pos.rl, size.rb, base.vb, {field.rv}, dst.wl 


° Find First 
FF{S,C} startpos.rl, size.rb, base.vb, {field.rv}, 
findpos.wl 

° Halt 


HALT {-(KSP).w*} 
Halts in Kernel mode, faults otherwise. 
Assigned opcode 0. 


e Increment 
INC{B,W,L} sum.mx 


e Index 
INDEX subscript.rl, low.rl, high.rl, size.rl, 
indexin.rl, indexout.wl 


e Insert Field 
INSV src.rl, pos.rl, size.rb, base.vb, {field.wv} 


e Insert Entry in Queue 
INSQUE entry.ab, pred.ab 


° Insert Entry into Queue at Head, Interlocked 
INSQHI entry.ab, header.aq 


e Insert Entry into Queue at Tail, Interlocked 
INSQTI entry.ab, header.aq 


e Jump 
JMP dst.ab 
° Jump to Subroutine 


JSB dst.ab, {-(SP).wl} 
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e Locate Character 1 
LOCC char.rb, len.rw, addr.ab, {RO-1.wl} 


e Load Process Context | 
LDPCTX {PCB.r*, -(KSP).w*} 
Legal only on interrupt stack. 


e Move 9 
MOV{B,W,L,F,D,G,H,Q,O} src.rx, dst.wx 


e Move Negated 7 
MNEG{B,W,L,F,D,G,H} src.rx, dst.wx 


° Move Complemented 3 
MCOM{B,W,L} src.rx, dst.wx 


® Move Zero-Extended 3 
MOVZ{BW,BL,WL} src.rx, dst.wy 


° Multiply 2 Operand 7 
MUL{B,W,L,F,D,G,H}2 mulr.rx, prod.mx 


e Multiply 3 Operand 7 
MUL{B,W,L,F,D,G,H}3 mulr.rx, muld.rx, prod.wx 


e Move Address 5 
MOVA{B,W,L=F,Q=D=G,0=H} src.ax, dst.wl 


e Move from PSL 1 
MOVPSL dst.wl 


° Move Character 3 Operand 1 
MOVC3 len.rw, srcaddr.ab, dstaddr.ab, {R0O-5.wl} 


e Move Character 5 operand 1 
MOVC5 srclen.rw, srcaddr.ab, fill.rb, dstlen.rw, 
dstaddr.ab, {R0O-5.wl} 


® Move Translated Characters 1 
MOVTC srclen.rw, srcaddr.ab, fill.rb, tbladdr.ab, 
dstlen.rw, dstaddr.ab, {RO-5.wl} 


e Move Translated Until Character 1 
MOVTUC srclen.rw, srcaddr.ab, esc.rb, tbladdr.ab, 
dstlen.rw, dstaddr.ab, {R0O-5.wl} 


e Match Characters 1 
MATCHC lent.rw, addr1.ab, len2.rw, addr2.ab, {RO-3.wl} 


e Move Packed 1 


INSTRUCTION SET AND OPCODE ASSIGNMENTS Page A-7 
Instruction Operand Formats 


MOVP len.rw, srcaddr.ab, dstaddr.ab, {RO-3.wl} 


e Multiply Packed 1 
MULP mulrlen.rw, mulraddr.ab, muldlen.rw, muldaddr.ab, 
prodien.rw, prodaddr.ab, {RO-5.wl} 


e Move To Process Register 1 
MTPR src.rl, procreg.rl 
Legal only in Kernel mode. 


° Move From Processor Register 1 
MFPR procreg.rl, dst.wl 
Legal only in Kernel mode. 


° No Operation 1 
NOP 
° Push Long 1 


PUSHL sre.rl, {-(SP).wl} 


° Polynomial Evaluation F_floating 1 
POLYF arg.rf, degree.rw, tbladdr.ab, {RO-3.wl} 


° Polynomial Evaluation D_ floating 1 
POLYD arg.rd, degree.rw, tbladdr.ab, {RO-5.wi} 


° Polynomial Evaluation G_ floating 1 
POLYG arg.rg, degree.rw, tbladdr.ab, {RO-5.wl} 


° Polynomial Evaluation H_ floating 1 
POLYH arg.rh, degree.rw, tbladdr.ab, {RO-5.wl,-16(SP):-1(SP).wb} 


e Push Address 5 
PUSHA{B,W,L=F,Q=D=G,O=H} src.ax, {-(SP).wl} 


e Push Registers 1 
PUSHR mask.rw, {-(SP).w*} 


e Pop Registers 1 
POPR mask.rw, {(SP)+.r*} 


e Probe {Read, Write} Accessability 2 
PROBE{R,W} mode.rb, len.rw, base.ab 


e Rotate Long | 
ROTL cnt.rb, src.rl, dst.wl 


e Return from Subroutine 1 
RSB {(SP) + .rl} 


e Return from Procedure 1 
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RET {(SP)+.r*} 


° Remove Entry from Queue 1 
REMQUE entry.ab, addr.wl 


e Remove Entry from Queue at Head, Interlocked 1 
REMQHI header.aq, addr.wi 


e Remove Entry from Queue at Tail, Interlocked 1 
REMQTI header.aq, addr.wl 


e Return from Exception or Interrupt 1 
REI {(SP)+.r*} 


° Subtract 2 Operand 7 
SUB{B,W,L,F,D,G,H}2 sub.rx, dif.mx 


e Subtract 3 Operand 7 
SUB{B,W,L,F,D,G,H}3 sub.rx, min.rx, dif.wx 


e Subtract With Carry | 
SBWC sub.rl, dif.ml 


° Subtract One and Branch Greater Than or Equal 1 
SOBGEQ index.ml, displ.bb 


e Subtract One and Branch Greater Than 1 
SOBGTR index.ml, displ.bb 


e Scan Characters 1 
SCANC len.rw, addr.ab, tbladdr.ab, mask.rb, {RO-3.wl} 


e Span Characters 1 
SPANC len.rw, addr.ab, tbladdr.ab, mask.rb, {RO-3.wl} 


e Skip Character 1 
SKPC char.rb, len.rw, addr.ab, {RO-1.wl} 

° Subtract Packed 4 Operand 1 
SUBP4 sublen.rw, subaddr.ab, diflen.rw, difaddr.ab, 
{RO-3.wl} 

e Subtract Packed 6 Operand 1 


SUBP6 sublen.rw, subaddr.ab, minlen.rw, minaddr.ab, 
diflen.rw, difaddr.ab, {RO-5.wl} 


° Save Process Context 1 
SVPCTX {(SP)+.r*, PCB.w*} 
Legal only in Kernel mode. 


° Test 7 
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TST{B,W,L,F,D,G,H} sre.rx 


e Extended Function Call 1 
XFC {unspecified operands} 


e Exclusive OR 2 Operand 3 
XOR{B,W,L}2 mask.rx, dst.mx 


° Exclusive OR 3 Operand 3 
XOR{B,W,L}3 mask.rx, src.rx, dst.wx 


Total 304 
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A.2 OPERAND SPECIFIER NOTATION 


The standard VAX notation for operand specifiers is: 
<name>.<access type><data type> 
where: 


1. Name iS a suggestive name for the operand in the 
context of the instruction. It 1s the capitalized 
name of a register or block for implied operands. 


2. Access type is a letter denoting the operand 
specifier access type. 

a - Calculate the effective address of the 
specified operand. Address 1s returned in a 
pointer which is the actual instruction operand. 
Context of address calculation is given 
by data type given by <data type>. 

b - No operand reference. Operand specifier is 
branch displacement. Size of branch 
displacement is given by <data type>. 

—- operand is modified (both read and written) 

- operand is read only 

- if not "Rn", same as a. If "Rn", R{n+1]'R{in]. 
- operand 1S written only 


~€<ns3 


3. Data type is a letter denoting the data type of the 


operand 
b - byte 
d - D floating 
£ - F floating 
g - G floating 
h - H floating 
1 - longword 
Oo - octaword 
gq - quadword 
v - field (used only on implied operands) 
w - word 
x - first data type specified by instruction 
y —- second data type specified by instruction 
* 


- multiple longwords (used only on implied operands) 


For names, the following names and abbreviations are used: 
e add - addend 


e addr - address 
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arglist - argument list 
base - base 

char - character 

cnt - count 

dif - difference 

displ - displacement 
divd - dividend 

divr - divisor 

dst - destination 
entry - entry 

esc - escape 

fill - fill 

findpos - find position 
fract - fraction 

index - index 


inicre - initial cre 


int - integer 
len - length 
limit - limit 


mask - mask 

min - minuend 
muld - multiplicand 
mulr - multiplier 


mulrx - multiplier extension 


numarg - number of arguments 


option - option 
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° param - parameter 

e pos - position 

e pred - predecessor 

e procreg - internal processor register 


e prod - product 


° quo - quotient 

e rem - remainder 

° selector - selector 

e size - size 

e src - source 

e Startpos - starting position 
e stream - stream 

e Strlen - string length 

e sub - subtrahend 

e sum - sum 


e tbl - table 
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A.3 OPCODE ASSIGNMENTS 


SINGLE BYTE OPCODES 


Binary Hex 


00000000 
00000001 
00000010 
00000011 
00000100 
00000101 
00000110 
00000111 


00001000 
00001001 
00001010 
00001011 
00001100 
00001101 
00001110 
00001111 


00010000 
00010001 
00010010 
00010011 
00010100 
00010101 
00010110 
00010111 


00011000 
00011001 
00011010 
00011011 
00011100 
00011101 
00011110 
00011111 


Mnemonic 


LDPCTX 


INSQUE 
REMQUE 


BSBB 
BRB 


BNEQ , BNEQU 
BEQL , BEQLU 


BGTR 


BVS 


BGEQU , BCC 
BLSSU,BCS 


Binary Hex 


00100000 
00100001 
00100010 
00100011 
00100100 
00100101 
00100110 
00100111 


00101000 
00101001 
00101010 
00101011 
00101100 
00101101 
00101110 
00101111 


00110000 
00110001 
00110010 
00110011 
00110100 
00110101 
00110110 
00110111 


00111000 
00111001 
00111010 
00111011 
00111100 
00111101 
00111110 
00111111 


20 
21 
22 
23 
24 
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ADDP4 
ADDP6 
SUBP4 
SUBP6 
CVTPT 
MULP 

CVTTP 
DIVP 


MOVC3 
CMPC3 
SCANC 
SPANC 
MOVC5 
CMPC5 
MOVTC 
MOVTUC 


EDITPC 
MATCHC 
LOCC 
SKPC 
MOV ZWL 
ACBW 
MOVAW 
PUSHAW 
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Binary Hex 


01000000 
01000001 
01000010 
01000011 
01000100 
01000101 
01000110 
01000111 


01001000 
01001001 
01001010 
01001011 
01001100 
01001101 
01001110 
01001111 


01010000 
01010001 
01010010 
01010011 
01010100 
01010101 
01010110 
01010111 


01011000 
01011001 
01011010 
01011011 
01011100 
01011101 
01011110 
01011111 


40 
41 
42 
43 
44 
45 
46 
47 


Mnemonic 


ADDF2 
ADDF3 
SUBF2 
SUBF3 
MULF2 
MULF3 
DIVF2 
DIVF3 


CVTFB 
CVTFW 
CVTFL 
CVTRFL 
CVTBF 
CVTWF 
CVTLF 
ACBF 


MOVF 
CMPF 
MNEGF 
TSTF 
EMODF 
POLYF 
CVTFD 
RESERVED to 


ADAWI 
RESERVED to 
RESERVED to 
RESERVED to 
INSQHI 
INSQTI 
REMQH I 
REMQT I 


DEC 


DEC 
DEC 
DEC 


Binary Hex 


01100000 
01100001 
01100010 
01100011 
01100100 
01100101 
01100110 
01100111 


01101000 
01101001 
01101010 
01101011 
01101100 
01101101 
01101110 
01101111 


01110000 
01110001 
01110010 
01110011 
01110100 
01110101 
01110110 
01110111 


01111000 
01111001 
01111010 
01111011 
01111100 
01111101 
01111110 
01111111 


60 
61 
62 
63 
64 
65 
66 
67 
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Mnemonic 


ADDD2 
ADDD3 
SUBD2 
SUBD3 
MULD2 
MULD3 
DIVD2 
DIVD3 


CVTDB 
CVTDW 
CVTDL 
CVTRDL 
CVTBD 
CVTWD 
CVTLD 
ACBD 


MOVD 
CMPD 
MNEGD 
TSTD 
EMODD 
POLYD 
CVTDF 


RESERVED to DEC 


ASHL 
ASHQ 
BMUL 
EDIV 


CLRQ, CLRD, CLRG 


MOVQ 


MOVA{Q,D,G} 
PUSHA{Q,D,G} 
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Opcode Assignments 


Binary Hex 


10000000 
10000001 
10000010 
10000011 
10000100 
10000101 
10000110 
10000111 


10001000 
10001001 
10001010 
10001011 
10001100 
10001101 
10001110 
10001111 


10010000 
10010001 
10010010 
10010011 
10010100 
10010101 
10010110 
10010111 


10011000 
10011001 
10011010 
10011011 
10011100 
10011101 
10011110 
10011111 


80 
81 


Mnemonic 


ADDB2 
ADDB3 
SUBB2 
SUBB3 
MULB2 
MULB3 
DIVB2 
DIVB3 


BISB2 
BISB3 
BICB2 
BICB3 
XORB2 
XORB3 
MNEGB 
CASEB 


MOVB 
CMPB 
MCOMB 
BITB 
CLRB 
TSTB 
INCB 
DECB 


CVTBL 
CVTBW 


MOVZBL 
MOVZBW 


ROTL 
ACBB 
MOVAB 


PUSHAB 


Binary Hex 


10100000 
10100001 
10100010 
10100011 
10100100 
10100101 
10100110 
10100111 


10101000 
10101001 
10101010 
10101011 
10101100 
10101101 
10101110 
10101111 


10110000 
10110001 
10110010 
10110011 
10110100 
10110101 
10110110 
10110111 


10111000 
10111001 
10111010 
10111011 
10111100 
10111101 
10111110 
10111111 
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Mnemonic 


ADDW2 
ADDW3 
SUBW2 
SUBW3 
MULW2 
MULW3 
DIVW2 
DIVW3 


BISW2 
BISW3 
BICW2 
BICW3 
XORW2 
XORW3 
MNEGW 
CASEW 


MOVW 
CMPW 
MCOMW 
BITW 
CLRW 
TSTW 
INCW 
DECW 


BISPSW 
BICPSW 
POPR 
PUSHR 
CHMK 
CHME 
CHMS 
CHMU 
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Opcode Assignments 


Binary Hex 


11000000 
11000001 
11000010 
11000011 
11000100 
11000101 
11000110 
11000111 


11001000 
11001001 
11001010 
11001011 
11001100 
11001101 
11001110 
11001111 


11010000 
11010001 
11010010 
11010011 
11010100 
11010101 
11010110 
11010111 


11011000 
11011001 
11011010 
11011011 
11011100 
11011101 
11011110 
11011111 


Mnemonic 


ADDL2 
ADDL3 
SUBL2 
SUBL3 
MULL2 
MULL3 
DIVL2 
DIVL3 


BISL2 
BISL3 
BICL2 
BICL3 
XORL2 
XORL3 
MNEGL 
CASEL 


MOVL 
CMPL 
MCOML 
BITL 


CLRL,CLRF 


TSTL 
INCL 
DECL 


ADWC 
SBWC 
MTPR 
MFPR 


MOVPSL 


PUSHL 


MOVAL , MOVAF 
PUSHAL, PUSHAF 


Binary Hex 


11100000 
11100001 
11100010 
11100011 
11100100 
11100101 
11100110 
11100111 


11101000 
11101001 
11101010 
11101011 
11101100 
11101101 
11101110 
11101111 


11110000 
11110001 
11110010 
11110011 
11110100 
11110101 
11110110 
11110111 


11111000 
11111001 
11111010 
11111011 
11111100 
11111101 
11111110 
lililill 
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Mnemonic 


BBS 
BBC 
BBSS 
BBCS 
BBSC 
BBCC 
BBSSI 
BBCCI 


BLBS 
BLBC 
FFS 
FFC 
CMPV 
CMPZV 
EXTV 
EXTZV 


INSV 
ACBL 
AOBLSS 
AOBLEQ 
SOBGEQ 
SOBGTR 
CVTLB 
CVTLW 


ASHP 

CVTLP 

CALLG 

CALLS 

XFC 

ESCD to DEC 
ESCE to DEC 
ESCF to DEC 
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TWO BYTE OPCODES 


Hex Mnemonic Hex Mnemonic 
OOFD 

to 

31FD RESERVED to DIGITAL 

32FD CVTDH 33FD CVTGF 
34FD 

to 

3FFD RESERVED to DEC 
40FD ADDG2 60FD ADDH2 
41FD ADDG3 61FD ADDH3 
42FD SUBG2 62FD SUBH2 
43FD SUBG3 63FD SUBH3 
44FD MULG2 64FD MULH2 
45FD MULG3 65FD MULH3 
46FD DIVG2 66FD DIVH2 
47FD DIVG3 67FD DIVH3 
48FD CVTGB 68FD CVTHB 
49FD CVTGW 69FD CVTHW 
4AFD CVTGL 6AFD CVTHL 
4BFD CVTRGL 6BFD CVTRHL 
4CFD CVTBG 6CFD CVTBH 
4DFD CVTWG 6DFD CVTWH 
4EFD CVTLG 6EFD CVTLH 
4FFD ACBG 6FFD ACBH 
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Opcode Assignments 


MOVG 
CMPG 
MNEGG 
TSTG 
EMODG 
POLYG 
CVTGH 
RESERVED 


RESERVED 
RESERVED 
RESERVED 
RESERVED 
RESERVED 
RESERVED 
RESERVED 
RESERVED 


RESERVED 


CVTFH 


RESERVED 


CVTHF 


RESERVED 


to 


to 
to 
to 
to 
to 
to 
to 
to 


to 


me) 


to 


DEC 


DEC 
DEC 
DEC 
DEC 
DEC 
DEC 
DEC 
DEC 


DIGITAL 


DIGITAL 


DIGITAL 


99FD 


F7FD 


BUGL (used by VMS for BUGCHECK) FEFF 


RESERVED for all time 
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MOVH 
CMPH 
MNEGH 
TSTH 
EMODH 
POLYH 
CVTHG 
RESERVED 


RESERVED 
RESERVED 
RESERVED 
RESERVED 


CLRH , CLRO 


MOVO 


MOVAH , MOVAO 


to 


to 
to 
to 
to 


DEC 


DEC 
DEC 
DEC 
DEC 


PUSHAH , PUSHAO 


CVTFG 


CVTHD 


BUGW 
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A.4 INSTRUCTIONS USABLE TO REFERENCE I/O SPACE 

Some of the instructions are not usable to reference I/O space. The reasons for this are: 
e String instructions are restartable via PSL<FPD> 
e The instruction is not in the kernel set 
° The PC, SP, or PCBB can not point to I/O space 


e I/O space does not support operand types of quad, floating, field, or queue; nor can the 
position, size, length, or base of them be from I/O space 


° The instruction may be interruptible because it is potentially a slow instruction in some 
implementations 


e Only instructions with a maximum of one modify or write destination can be used. The destination 
must be the last operand 


For any memory reference to I/O space, the programmer must use an instruction from the following lists 
and must ensure that no interrupts or faults will occur, including page faults, after the first I/O space 
reference. To ensure no interrupts, the programmer must avoid operand specifier modes 9, 11, 13, and 
15, and these modes indexed. (Symbolically, these are @(Rn)+, @B’*D(Rn), @W*D(Rn), and @L’*D(Rn), and 
these indexed.) The hardware may allow interrupts for these modes in order to minimize interrupt latency. 
For the instructions in the following lists, the hardware ensures that no other interrupts will occur after the 
first I/O space access. 


Since these instructions are not interruptable after I/O space accesses (except for the addressing modes 
above), their execution will extend the interrupt latency. The programmer should make some effort to keep 
them short by minimizing the number of memory references. Use RO through R13 instead, for example. 


Instructions for which any explicit operand can be in I/O space: 


MOV{B,W,L}, PUSHL, CLR{B,W,L}, MNEG{B,W,L}, MCOM{B,W,L}, MOVZ{BW,BL,WL}, 
CVT{BW,BL,WB,WL,LB,LW}, CMP{B,W,L}, TST{B,W,L}, ADD{B,W,L}2, ADD{B,W,L}3, ADAWI, INC{B,W,L}, 
ADWC, SUB{B,W,L}2, SUB{B,W,L}3, DEC{B,W,L}, SBWC, BIT{B,W,L}, BIS{B,W,L}2, BIS{B,W,L}3, 
BIC{B,W,L}2, BIC{B,W,L}3, XOR{B,W,L}2, XOR{B,W,L}3, MOVA{B,W,L}, MOVAQ, PUSHA{B,W,L}, PUSHAQ, 
CASE[B,W,L}, MOVPSL, BISPSW, BICPSW, CHM{K,E,S,U} PROBE{R,W}, MTPR, MFPR 


Instructions for which all operands except the branch displacement can be in I/O space: 


BLB{S,C} 


Instruction for which some operand can be in I/O space: 


XFC (depending on implementation) 
REMQUE addr (destination) 
REMQHI addr (destination) 
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REMQTI addr (destination) 


Notwithstanding the above rules, it is possible for a specific hardware implementation to execute macro 
code from the I/O space and/or to allow the stack or PCB to be in I/O space. This might, for example, be 
used as part of the bootstrap process. If this is done, then it is valid for software to transfer to this code. 


[End of Appendix A] 


APPENDIX B 


ARCHITECTURAL SUBSETTING 


This appendix describes those parts of the VAX architecture which may be either omitted completely from 
a processor, or provided to customers as a processor option. The subsetting of the architecture reflects the 
trade-offs between manufacturing cost, software development cost, and performance across all future machines 
implemented in the VAX family. 


B.1 GOALS 


These guidelines are an attempt to reach a compromise on the following conflicting hardware and software 
goals for all processors produced in the future in the VAX family: 


e Hardware goal - Permit an implementor of a low end processor to omit instructions and other 
features in order to reduce manufacturing cost without losing the ability to run all of the system 
software. The decision to implement a subset will have some impact on the performance of 
various classes of software products. 


e Software goal - Provide as small a number of classes of processor instruction sets as possible 
to reduce software development costs. In particular, a single version of each compiler or other 
layered software product should run on all processors in the VAX family. Also the combination 
of hardware and instruction emulation routines in operating systems must (as required) give 
the appearance of a complete architecture on all processors. 


B.2 INSTRUCTION SET SUBSETTING 


B.2.1 DEFINITIONS 


Kernel Instruction Set - The kernel instruction set is that subset of the VAX architecture which is always 
present in all processors in the VAX family. 


Subsettable instructions - The subsettable instructions are the instructions in the VAX architecture which 
processor implementors may choose: (1) to omit completely, (2) to include as a processor option, or (3) to 
include in the basic processor. 


Processor option - An implementation technique whereby a particular processor is designed to provide 
customers the ability to purchase additional hardware to provide some or all of the omitted instructions or 
other processor features. 
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The Kernel instruction set includes all of the instructions in the architecture, except the following classes of 
subsettable instructions: 


° F_floating* - MOVF, MNEGF, CVTF{B,W,L}, CVT{B,W,L}F, CMPF, TSTF, ADDF2, ADDF3, 
SUBF2, SUBF3, MULF2, MULF3, DIVF2, DIVF3, CVTRFL, EMODF, POLYF, ACBF. 


° D_floating* - MOVD, MNEGD, CVTD{B,W,L,F}, CVT{B,W,L,F}D, CMPD, TSTD, ADDD2, 
ADDD3, SUBD2, SUBD3, MULD2, MULD3, DIVD2, DIVD3, CVTRDL, EMODD, POLYD, ACBD. 


©  G_floating*‘ - MOVG, MNEGG, CVTG{B,W,L,F}, CVT{B,W,L,F}G, CMPG, TSTG, ADDG2, 
ADDG3, SUBG2, SUBG3, MULG2, MULG3, DIVG2, DIVG3, CVTRGL, EMODG, POLYG, ACBG. 


° H_floating* - MOVH, MNEGH, CVTH{B,W,L,F,D,G}, CVT{B,W,L,F,D,G}H, CMPH, TSTH, 
ADDH2, ADDH3, SUBH2, SUBH3, MULH2, MULH3, DIVH2, DIVH3, CVTRHL, EMODH, 
POLYH, ACBH, MOVO, CLRH/CLRO, MOVAH/MOVAO, PUSHAH/PUSHAO. 


° Character* - MOVTC, MOVTUC, CMPC3, CMPC5, SCANC, SPANC, LOCC, SKPC, MATCHC. 


e Packed* - MOVP, CMPP3, CMPP4, ADDP4, ADDP6, SUBP4, SUBP6, CVTLP, CVTPL, CVTPT, 
CVTTP, CVTPS, CVTSP, ASHP, MULP, DIVP. 


e Edit - EDITPC 
° Cyclic Redundancy Check - CRC 


e PDP-11 Compatibility Mode. 


*Note: All forms of the address data type except for octaword and all forms of context indexing have been 
included in the kernel set. In addition, MOVC3 and MOVC5 are part of the kernel set. MOVC3 is the 
recommended technique for moving blocks of data. Using MOVC5 with a zero length source is the 
recommended technique for clearing an area of memory. 


B.2.2 Subsetting Rules 


The subsettable classes can be divided into three groups with different rules for subsetting. The first group 
consists of F_floating, D_floating, G_floating, and H_floating. Each of these classes may only be subset 
as an entity. This means that if any instruction of a class is included, all instructions of that class must be 
included. If these instructions are not implemented by a processor, a reserved instruction fault is taken (see 
Chapter 6). 


The second group of subsettable classes consists of character string (except MOVC3 and MOVCS5), decimal 
string, EDITPC, and CRC. Instructions in these classes may be subset individually. Unimplemented instructions 
in this group must push operand specifier information on the current mode stack and take an emulated 
instruction fault as specified in the section on Instruction Emulation support. 


The third group comprises the compatibility mode instruction set. A VAX processor may choose to not 
implement compatibility mode. On these processors, a REl instruction attempting to enter compatibility mode 
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results in a reserved operand fault. 


B.3 SUBSETTING OF INTERNAL PROCESSOR REGISTERS 


Some low-end processors may choose to not implement the following VAX internal processor registers: 


° Interval timer registers 

e Time-of-year clock registers 

e Console registers 

e Performance Monitor Enable register 


B.4 KNOWN SUBSETS 
The following subset implementations exist currently: 


e G_floating and H_floating instructions are implemented on the VAX-11/780 and VAX-11/750 
as processor options. 


e MicroVAX-l implements the microVAX subset, CMPC3, LOCC, SCANC, SKPC, SPANC, and 
all architecturally defined VAX internal processor registers except PMR. 


° The microVAX chip implements the microVAX subset and D_floating. 


B.4.1 The MicroVAX Subset 


The microVAX subset is tailored to facilitate single-chip implementations of the VAX architecture. The 
microVAX architecture is a strict subset of the VAX architecture: 


e a subset of VAX data types 
- no D_floating data type 
- no H_floating data type 
- no octaword data type 
- no numeric string data types 


- no packed decimal data type 


e a subset of the VAX instruction set 
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- no decimal string instructions 

- no character string instructions (except MOVC3/MOVC5) 

- no EDITPC instruction 

- no CRC instruction 

- emulation support for above mentioned non-implemented instructions 

- optional F_floating and G_floating instructions 

- no D_floating or H_floating instructions 


- no compatibility mode instructions 


e a subset of VAX privileged processor registers 
- subset interval timer 
- no time-of-year clock registers 
- no console registers 


- no Performance Monitor Enable register 


B.5 EMULATION OF MISSING INSTRUCTIONS 


B.5.1 INSTRUCTION EMULATION SUPPORT 
Microvax provides special emulation support for the following instructions: 


° Character string: MOVTC, MOVTUC, SKPC, LOCC, SCANC, SPANC, MATCHC, CMPC3, 
CMPC5. 


° Decimal string: MOVP, CMPP3, CMPP4, ADDP4, ADDP6, SUBP4, SUBP6, MULP, DIVP, ASHP, 
CVTPL, CVTLP, CVTPS, CVTSP, CVTTP, CVTPT. 


° Cyclic redundancy check: CRC. 


e Edit: EDITPC. 
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If TP is set a trace fault occurs. If TP is clear and FPD is clear, the emulation process consists of the 
following steps: 


Evaluate the operand specifiers in order of instruction stream occurrence. Save the address 
for address and modify access type; read the operand and save it for read access type. 


The exception stack contains 10 longword parameters (in addition to the PC and PSL to be 
restored on returning from this exception) as follows: 


3 


1 0) 


The opcode parameter contains the opcode of the instruction to be emulated. The old PC 
points to the location of the instruction causing the exception. The specifier parameters contain 
the address of the operand or the operand itself. For an .rx specifier, the parameter is the 
operand value; for .wx and .ax specifiers, the parameter is the operand address. A register 
is denoted by a reserved system space address corresponding to the one’s complement of 
the register number. The parameter corresponding to a specifier that does not exist is 
UNPREDICTABLE. The new PC points to the instruction following the instruction causing the 
exception. 


: (SP) 


Initiate an exception in current mode through the emulated instruction vector using C8(hex) as 
the SCB offset. The FPD bit in the saved PSL is clear. The TP bit in the saved PSL is set 
if T was set. The T, TP, IV, DV, FU and condition code bits in the new PSL are cleared. All 
other bits in the new PSL are unchanged from their previous state. 


If FPD is set, a suspended emulated instruction fault is taken in current mode through a vector 
at SCB offset CC(hex). No parameters are pushed. The TP bit in the saved PSL is set if T 
was set. All other bits in the saved PSL are unchanged. The saved PC points to the instruction 
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causing the exception. The FPD, T, TP, IV, DV, FU and condition code bits in the new PSL 
are cleared. All other bits in the new PSL are unchanged from their previous state. 
NOTE 


Some microVAX processors may implement some or all of the instructions listed in 
this section instead of providing emulation support. 


B.5.2 Implications On VAX Operating Systems 


Each VAX operating system must provide emulation software for those unimplemented instructions used by 
its layered software including its macro assembler (if supported). 


[End of Appendix B] 
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INDEX 
! command, 11-10 ACBW - Add Compare and Branch 
() Word, 4-49 
as a notation, 3-3 Access across page boundaries, 
* symbolic address, 11-11 5=12 
+ symbolic address, 11-1l Access control, 5-10 
- symbolic address, 11-11 Access control violation fault, 
/B qualifier, 11-12 6-11 
/C qualifier, 11-12 Access mode, 2-15 
/G qualifier, 11-12 memory, 2-15 
/1 qualifier, 11-12 Access mode, memory, 5-10 
/“G qualifier, 11-12 Executive, 5-10 
/M qualifier, 11-12 Kernel, 5-10 
/N qualifier, 11-12 Supervisor, 5-10 
/P qualifier, 11-12 User, 5-10 
/S qualifier, 11-14 Access type, operand, 3-2 
/U qualifier, 11-12 address, 3-2, 3-15 
/V qualifier, 11-12 branch, 3-2, 3-15 
/W qualifier, 11-12 modify, 3-2, 3-15 
@ command, 11-10, 11-17 synchronization, 3-16 
@ qualifier, 11-11 read, 3-2, 3-15 
“P control character, 11-8 write, 3-2, 3-15 
ACCS initialization, 11-5 
as a notation, 3-3 ADAWI 
Add Aligned Word Interlocked, 
abbreviations of command keywords, 4-9 
11-9 ADDB2 - Add Byte 2 Operand, 4-10 
Abort, 6-1 to 6-2 ADDB3 - Add Byte 3 Operand, 4-10 
Absolute addressing mode, 3-6 ADDD2, B-2 
Absolute indexed addressing mode, ADDD2 - Add D floating 2 Operand, 
3-12 4-119 
Absolute indexed mode, 3-12 ADDD3, B-2 
Absolute mode, 3-6 ADDD3 - Add D floating 3 Operand, 
Absolute queues, 4-89 4-119 
ACBB - Add Compare and Branch ADDF2, B-2 
Byte, 4-49 ADDF2 - Add F floating 2 Operand, 
ACBD, B-2 4-119 
ACBD - Add Compare and Branch ADDF3, B-2 
D floating, 4-49 ADDF3 - Add F floating 3 Operand, 
ACBF, B-2 4-119 
ACBF - Add Compare and Branch ADDG2, B-2 
F floating, 4-49 ADDG2 - ADD G floating 2 Operand, 
ACBG, B-2 4-119 
ACBG - Add Compare and Branch ADDG3, B-2 
G floating, 4-49 ADDG3 - ADD G floating 3 Operand, 
ACBH, B-2 4-119 
ACBH - Add Compare and Branch ADDH2, B-2 
H floating, 4-49 ADDH2 - ADD H floating 2 Operand, 
ACBL - Add Compare and Branch 4-119 


Long, 4-49 ADDH3, B-2 


ADDH3 - ADD H floating 3 Operand, 


4-119 
ADDL2 - Add Long 2 Operand, 4-10 
ADDL3 - Add Long 3 Operand, 4-10 
ADDP4, B-2 
ADDP4 - Add Packed 4 Operand, 
4-174 
ADDP6, B-2 
ADDP6 - Add Packed 6 Operand, 
4-174 
Address, 2-1 
Address access type, operand, 
3-2, 3-15 
Address arguments, validating, 
5-22 
Address instructions, 4-38 
address space identifier, 11-13 
address space qualifier 
machine dependent, 11-12 
Address translation, 5-6 
address translation, 11-13 
Addressing modes notation, 3-3 
ADDW2 - Add Word 2 Operand, 4-10 
ADDW3 - Add Word 3 Operand, 4-10 
ADWC - Add With Carry, 4-11 
Alignment 
stack, 6-25 
target of control, 4-47 
ambiguous commands, 11-9 
AOBLEQ - Add One and Branch 
Less Than or Equal, 4-51 
AOBLSS - Add One and Branch 
Less Than, 4-52 
AP - Argument Pointer Register, 
2-13 
Argument Pointer Register, 2-13 
Arithmetic faults, 6-9 
Arithmetic instructions 
decimal string, 4-169 
floating point, 4-113 
integer, 4-6 
Arithmetic traps, 6-9 
Array addressing, 3-12 
ASCII console, 11-8 
ASHL - Arithmetic Shift Long, 
4-12 
ASHP, B-2 


ASHP - Arithmetic Shift and Round 


Packed, 4-176 
ASHQ - Arithmetic Shift Quad, 
4-12 
AST - Asynchronous System Traps, 
6-4, 6-23 to 6-24, 6-31 
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AST, Asynchronous System Traps, 
7-6 
ASTLVL - Asynchronous System 
Trap Level, 6-4, 6-13, 6-30 
ASTLVL - Pending AST Level, 7-4 
ASTLVL initialization, 11-5 
Autodecrement addressing mode, 
3-6 
Autodecrement indexed 
addressing mode, 3-12 
Autodecrement indexed mode, 
Autodecrement mode, 3-6 
Autoincrement addressing mode, 
3-5 
Autoincrement deferred 
addressing mode, 3-6 
Autoincrement deferred indexed 
addressing mode, 3-12 
mode, 3-12 
Autoincrement deferred mode, 3-6 
Autoincrement indexed 
addressing mode, 3-12 
Autoincrement indexed mode, 
Autoincrement mode, 3-5 


3-12 


S212 


Base operand specifier, 3-12 
Base register, 2-13 
battery backup, 11-3 to 11-4, 
11-6 
BBC - Branch on Bit Clear, 4-55 
BBCC - Branch on Bit Clear 
and Clear, 4-56 
BBCCI - Branch on Bit Clear 
and Clear Interlocked, 4-57 
BBCS - Branch on Bit Clear 
and Set, 4-56 
BBS - Branch on Bit Set, 4-55 
BBSC - Branch on Bit Set 
and Clear, 4-56 
BBSS - Branch on Bit Set 
and Set, 4-56 
BBSSI - Branch on Bit Set 
and Set Interlocked, 4-57 
BCC - Branch on Carry Clear, 
4-53 
BCS - Branch on Carry Set, 4-53 
BEQL - Branch on Equal, 4-53 
BEQLU - Branch on Equal Unsigned, 
4-53 
BGEQ - Branch on Greater Than 
or Equal, 4-53 
BGEQU - Branch on Greater Than 
or Equal Unsigned, 4-53 


BGTR - Branch on Greater Than, 
4-53 
BGTRU - Branch on Greater Than 
Unsigned, 4-53 


BICB2 - Bit Clear Byte 2 Operand, 


4-13 


BICB3 - Bit Clear Byte 3 Operand, 


4-13 


BICL2 - Bit Clear Long 2 Operand, 


4-13 


BICL3 - Bit Clear Long 3 Operand, 


4-13 
BICPSW - Bit Clear PSW, 4-77 


BICW2 - Bit Clear Word 2 Operand, 


4-13 


BICW3 - Bit Clear Word 3 Operand, 


4-13 
binary load command (X command), 
11-16 


binary unload command (X command), 


11-16 

BISB2 - Bit Set Byte 2 Operand, 
4-14 

BISB3 - Bit Set Byte 3 Operand, 
4-14 

BISL2 - Bit Set Long 2 Operand, 
4-14 

BISL3 - Bit Set Long 3 Operand, 
4-14 

BISPSW - Bit Set PSW, 4-78 

BISW2 - Bit Set Word 2 Operand, 
4-14 

BISW3 - Bit Set Word 3 Operand, 
4-14 

Bit efficiency 
as a goal, l1-l 

BITB - Bit Test Byte, 4-15 

BITL - Bit Test Long, 4-15 

BITW - Bit Test Word, 4-15 

BLBC - Branch on Low Bit Clear, 


BLBS - Branch on Low Bit Set, 


BLEQ - Branch on Less Than 
or Equal, 4-53 
BLEQU - Branch on Less Than 
or Equal Unsigned, 4-53 
BLSS - Branch on Less Than, 4-53 
BLSSU - Branch on Less Than 
Unsigned, 4-53 
BNEQ - Branch on Not Equal, 4-53 
BNEQU - Branch on Not Equal 
Unsigned, 4-53 
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BOOT command, 11-2, 
11-8 to 11-10 
bootstrap, 11-1, 11-8, 11-10 
bootstrap algorithm, 11-2 
bootstrap in progress flag, 
11-2, 11-6 
initialization, 11-6 
BPT - Breakpoint Fault, 4-79 
Braces 
as a notation, 3-3 
Branch access type, operand, 
3=2; 3215 
Branch displacement addressing, 
3-14 
BRB - Branch Byte Displacement, 
4-60 
Breakpoint fault, 6-14 
BRW - Branch Word Displacement, 
4-60 
BSBB - Branch to Subroutine 
Byte Displacement, 4-61 
BSBW - Branch to Subroutine 
Word Displacement, 4-61 
Bugcheck, 4-219 
BUGL, 4-219 
BUGW, 4-219 
bus initialization, 11-5, 11-16 
BVC - Branch on Overflow Clear, 
4-53 
BVS - Branch on Overflow Set, 
4-53 
Byte, 2-1 
Byte data type, operand, 3-2 
Byte displacement 
addressing mode, 3-7 
Byte displacement deferred 
addressing mode, 3-8 
indexed addressing mode, 
3-12 
indexed mode, 3-12 
Byte displacement deferred mode, 
3-8 
Byte displacement indexed 
addressing mode, 3-12 
Byte displacement indexed mode, 
3-12 
Byte displacement mode, 3-7 
byte qualifier, 11-12 


C - Carry Condition Code, 2-15 
C condition code, 2-15 

Cache, 8-5 

cache initialization, 11-5 


Call frame, 4-68 

CALLG - Call Procedure With 
General Argument List, 4-70 

CALLS - Call Procedure With 
Stack Argument List, 4-72 


case, upper and lower, 11-9 
CASEB - Case Byte, 4-62 
CASEL - Case Long, 4-62 


CASEW - Case Word, 4-62 

Change mode instructions, 6-32 

Character, 2-7 
fill, 4-198 
Sign, 4-198 

Character string data type, 2-7 

Character string instructions, 
4-142 

Check protection, 4-213 

checksum in RPB, 11-4 

checksum in X command, 11-17 

CHME - Change Mode to Executive, 
6-32 

CHME -- Change Mode to Executive, 
4-218 

CHMK - Change Mode to Kernel, 
6-32 

CHMK -- Change Mode to Kernel, 
4-218 

CHMS - Change Mode to Supervisor, 
6-32 


CHMS -- Change Mode to Supervisor, 
4-218 

CHMU - Change Mode to User, 6-32 

CHMU -- Change Mode to User, 
4-218 

Clock Registers, 9-8 

Clock, interval, 9-9 

clocks initialization, 11-6 

CLRB - Clear Byte, 4-16 

CLRD - Clear D floating, 4-121 

CLRF - Clear F floating, 4-121 

CLRG - Clear G floating, 4-121 

CLRH, B-2 

CLRH - Clear H floating, 4-121 

CLRL - Clear Long, 4-16 

CLRO, B-2 

CLRO - Clear Octa, 4-16 

CLRQO - Clear Quad, 4-16 

CLRW - Clear Word, 4-16 

CM - Compatibility Mode, 2-15 


CMPB - Compare Byte, 4-17 
CMPC3, B-2 
CMPC3 - Compare Characters 


3 Operand, 4-144 
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CMPC5, B-2 
CMPC5 - Compare Characters 
5 Operand, 4-144 
CMPD, B-2 
CMPD - Compare 
CMPF, B-2 
CMPF - Compare 
CMPG, B-2 
CMPG - Compare 
CMPH, B-2 
CMPH - Compare 
CMPL - Compare 
CMPP3, B-2 
CMPP3 - Compare Packed 
3 Operand, 4-178 
CMPP4, B-2 
CMPP4 -—- Compare Packed 
4 Operand, 4-178 
CMPV - Compare Field, 4-42 
CMPW - Compare Word, 4-17 
CMPZV - Compare Zero Extended 
Field, 4-42 
command files (@ command), 11-17 
command keyword abbreviation, 
11-9 
command length, 11-9 
command qualifiers, 11-9 
comments, 11-18 
Compatibility 
as a goal, 1-l 
Compatibility mode, 2-15 
address modes, 10-2 
addresses, 10-5 
BPT fault, 10-6 
EMT fault, 10-7 
entering, 10-5 
exceptions, 10-6 
I/O, 10-9 
illegal instruction fault, 
10-7 
instructions, 10-3 
interrupts, 10-6 
IOT fault, 10-6 
leaving, 10-5 
memory management, 10-5 
processor registers, 10-9 
PSW, 10-2 
register mapping, 10-5 
registers, 10-2 
reserved instrucions, 10-4 
reserved instruction fault, 
10-6 
stack, 10-2 


D floating, 4-122 


F floating, 4-122 


G floating, 4-122 


H floating, 4-122 


Long, 4-17 


synchronization, 10-9 

T-bit, 10-7 

TRAP fault, 10-7 

trap instructions, 10-4 

unimplimented traps, 10-8 

user environment, 10-2 
compatibility mode, 11-12 
Compatibility mode exception, 

6-14 


Condition Codes, 2-14 to 2-15 


console, 11-8 
console command language, 11-8 
console errors and error messages, 
11-19 
console extensions, 11-18 
console I/O mode, 11-1, 11-8 
console locked at powerup, 
11-4, 11-7 
console options, 11-18 to 11-19 
Console Receive Control/Status 


register (RXCS), 9-7 
Console Receive Data Buffer 
register (RXDB), 9-7 
console subset, 11-18 
console switches, 11-7 
console terminal, 11-8 
Console terminal registers, 9-7 
Console Transmit Control/Status 
register (TXCS), 9-8 
Console Transmit Data Buffer 
register (TXDB), 9-8 
Constraints on I/O registers, 
8-7 
Context switching, 7-1 
Context, process, 2-14, 
6-3 to 6-4, 6-24, 7-1 
Context, system wide, 6-1, 6-24 
CONTINUE command, 11-8 to 11-10 
control characters, 11-9 
Control instructions, 4-47 
control key, 11-9 
control-C, 11-15 
control-P, 11-8 
Conventions 
general, 1-2 
in notation, 
CRC, B-2 
CRC - Calculate Cyclic 
Redundancy Check, 4-168 
CSS, Reserved to, 1-3 
CUR_MOD - Current Mode, 2-15 
Currency Sign, 4-198 
Current Frame Pointer Register, 


6-1, 


4-5 


2-13 


Current mode, 2- 


Customers, 
CVTBD, B-2 
CVTBD - Convert 
D floating, 
CVTBF, B-2 
CVTBF - Convert 
F floating, 
CVTBG, B-2 
CVTBG - Convert 
G floating, 
CVTBH, B-2 
CVTBH - Convert 
H floating, 
CVTBL - Convert 
4-18 
CVTBW - Convert 
4-18 
CVTDB, B-2 
CVTDB - Convert 
Byte, 4-123 
CVTDF, B-2 
CVTDF - Convert 
F floating, 
CVTDH, B-2 
CVTDH - Convert 
H floating, 
CVTDL, B-2 
CVTDL - Convert 
Long, 4-123 
CVTDW, B-2 
CVTDW - Convert 
Word, 4-123 
CVTFB, B-2 
CVTFB - Convert 
Byte, 4-123 
CVTFD, B-2 
CVTFD - Convert 
D floating, 
CVTFG, B-2 
CVTFG - Convert 
G floating, 
CVTFH, B-2 
CVTFH - Convert 
H floating, 
CVTFL, B-2 
CVTFL - Convert 
Long, 4-123 
CVTFW, B-2 
CVTFW - Convert 
Word, 4-123 
CVTGB, B-2 


Reserved to, 
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15 
Byte to 
4-123 


Byte to 
4-123 


Byte to 
4-123 


Byte to 
4-123 


L=3 


Byte to Long, 


Byte to Word, 


D floating 


D floating 
4-123 


D floating 
4-123 


D floating 
D floating 
F floating 


F floating 
4-123 


F floating 
4-123 


F floating 
4-123 


F floating 


F floating 


to 


to 


to 


to 


to 


to 


to 


to 


to 


to 


to 


CVTGB - Convert 
Byte, 4-123 
CVTGF, B-2 
CVTGF - Convert 
F floating, 
CVTGH, B-2 
CVTGH - Convert 
H floating, 
CVTGL, B-2 
CVTGL - Convert 
Long, 4-123 
CVTGW, B-2 
CVTGW - Convert 
Word, 4-123 
CVTHB, B-2 
CVTHB - Convert 
Byte, 4-123 
CVTHD, B-2 
CVTHD - Convert 
D floating, 
CVTHF, B-2 
CVTHF - Convert 
F floating, 
CVTHG, B-2 
CVTHG - Convert 
G floating, 
CVTHL, B-2 
CVTHL - Convert 
Long, 4-123 
CVTHW, B-2 
CVTHW - Convert 
Word, 4-123 
CVTLB - Convert 
4-18 
CVTLD, B-2 
CVTLD - Convert 
D floating, 
CVTLF, B-2 
CVTLF - Convert 
F floating, 
CVTLG, B-2 
CVTLG - Convert 
G floating, 
CVTLH, B-2 
CVTLH - Convert 
H floating, 
CVTLP, B-2 
CVTLP - Convert 
4-180 
CVTLW - Convert 
4-18 
CVTPL, B-2 
CVTPL - Convert 


G floating to 
G floating to 
4-123 


G floating to 
4-123 


G floating to 
G floating to 
H floating to 
H floating to 


£123 


H floating to 
4-123 


H floating to 
47123 


H floating to 


H floating to 
Long to Byte, 
Long to 

4-123 


Long to 
4-123 


Long to 
4-123 


Long to 
4-123 


Long to Packed, 


Long to Word, 


Packed to Long, 
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4-181 
CVTPS, B-2 
CVTPS - Convert Packed 
to Leading Separate Numeric, 
4-183 
CVTPT, B-2 
CVTPT - Convert Packed 
to Trailing Numeric, 4-185 
CVTRDL, B-2 
CVTRDL - Convert Rounded 
D floating to Long, 4-123 
CVTRFL, B-2 
CVTRFL - Convert Rounded 
F floating to Long, 4-123 
CVTRGL, B-2 
CVTRGL - Convert Rounded 
G floating to Long, 4-123 
CVTRHL, B-2 
CVTRHL - Convert Rounded 
H floating to Long, 4-123 
CVTSP, B-2 
CVTSP - Convert Leading Separate 
Numeric to Packed, 4-187 
CVTTP, B-2 
CVTTP - Convert Trailing Numeric 
to Packed, 4-189 
CVTWB - Convert Word to Byte, 
4-18 
CVTWD, B-2 
CVTWD - Convert Word to 
D floating, 4-123 
CVTWF, B-2 
CVTWF - Convert Word to 
F floating, 4-123 
CVTWG, B-2 
CvTWG - Convert Word to 
G floating, 4-123 
CVTWH, B-2 
CVTWH - Convert Word to 
H floating, 4-123 
CVTWL - Convert Word to Long, 
4-18 
Cyclic redundancy check, 4-167 


D floating, 2-4 
D floating data type, 
operand, 3-2 

Data sharing, 8-1 

data size, 11-11 

Data synchronization, 8-l 

Data type 
character string, 2-7 
decimal string, 2-12 


floating, 2-3 to 2-5 
integer, 2-1 to 2-3 
packed decimal string, 2-12 
string, 2-7, 2-12 
variable length bit field, 2-6 
Data type, operand, 3-2 
byte, 3-2 
D floating, 3- 
F floating, 3- 
G floating, 3- 
H floating, 3- 
longword, 3-2 
octaword, 3-2 
quadword, 3-2 
word, 3-2 
Data types, 2-1 
DEC, Reserved to, 1-3 
DECB - Decrement Byte, 4-19 
decimal, 11-9 
Decimal overflow, 2-15 
Decimal string data type 
packed, 2-12 
Decimal string divide by 
zero trap, 6-10 
Decimal string instructions, 
4-169 
Decimal string overflow trap, 
6-10 
DECL - Decrement Long, 4-19 
DECW - Decrement Word, 4-19 
DEPOSIT command, 11-10 to ll-ll 
Digits 
Significant, 4-198 
digits, hexadecimal, 11-9 
Dispatch 
CHMx, 6-33 
Displacement addressing mode, 
3-7 
Displacement deferred indexed 
addressing mode, 3-12 
mode, 3-12 
Displacement mode, 3-7 
DIVB2 - Divide Byte 2 Operand, 
4-20 
DIVB3 - Divide Byte 3 Operand, 
4-20 
DIVD2, B-2 
DIVD2 - Divide D floating 
2 Operand, 4-126 
DIVD3, B-2 
DIVD3 - Divide D floating 
3 Operand, 4-126 
DIVF2, B-2 
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DIVF2 - Divide F floating 
2 Operand, 4-126 
DIVF3, B-2 
DIVF3 - Divide F floating 
3 Operand, 4-126 
DIVG2, B-2 
DIVG2 - Divide G floating 
2 Operand, 4-126 
DIVG3, B-2 
DIVG3 - Divide G floating 
3 Operand, 4-126 
DIVH2, B-2 
DIVH2 - Divide H floating 
2 Operand, 4-126 
DIVH3, B-2 
DIVH3 - Divide H floating 
3 Operand, 4-126 
Divide by zero fault, 6-11 
Divide by zero trap, 6-10 
DIVL2 - Divide Long 2 Operand, 
4-20 
DIVL3 - Divide Long 3 Operand, 
4-20 
DIVP, B-2 
DIVP - Divide Packed, 4-191 
DIVW2 - Divide Word 2 Operand, 
4-20 
DIVW3 - Divide Word 3 Operand, 
4-20 
done message, 11-18 
DV - Decimal Overflow Enable, 
2-15 


echo suppression in X command, 
i De 
Edit instruction, 4-198 
EDITPC, B-2 
EDITPC - Edit Packed to 
Character String, 4-199 
EDIV - Extended Divide, 4-22 
Efficiency, bit 
as a goal, 1-1 
EMODD, B-2 
EMODD - Extended Multiply and 
Integerize D floating, 4-128 
EMODF, B-2 
EMODF - Extended Multiply and 
Integerize F floating, 4-128 
EMODG, B-2 
EMODG - Extended Multiply and 
Integerize G floating, 4-128 
EMODH, B-2 
EMODH - Extended Multiply and 


Integerize H floating, 4-128 
EMUL - Extended Multiply, 4-23 
Emulation software, B-6 
Emulation support, B-4 
Entry mask, 4-68 
EOSADJUST_INPUT - Adjust Input 

Length, 4-205 
EOSBLANK ZERO - Blank Backwards 

When Zero, 4-206 
EOSCLEAR SIGNIF - Clear 

Significance, 4-216 
EOSEND - End Edit, 4-207 
EOSEND FLOAT - End Floating Sign, 

4-208 
EOSFILL - Store Fill, 4-209 
EOSFLOAT - Float Sign, 4-210 
EBOSINSERT - Insert Character, 
4-212 
EOSLOAD FILL - Load Fill 

Register, 4-213 
EOSLOAD MINUS - Load Sign 

Register If Minus, 4-213 
EOSLOAD PLUS - Load Sign 

Register If Plus, 4-213 
EOSLOAD SIGN - Load Sign 

Register, 4-213 
EOSMOVE - Move Digits, 4-214 
EOSREPLACE SIGN - Replace Sign 

When Zero, 4-215 
EOSSET_ SIGNIF - Set Significance, 

4-216 
EOSSTORE SIGN - Store Sign, 
4-217 
error halt, 11-8 
errors and error messages, 
Errors, processor, 8-7 
ESP - Executive Stack Pointer, 
7-4 
ESP initialization, 11-5 
EXAMINE command, 11-10, 
Exception, 6-2 to 6-3 
Exception condition, 6-1 
Exceptions detected during 

operand reference, 6-ll 

the operation, 6-9 
Exceptions occurring as the 

consequence of an 

instruction, 6-13 
Executive memory access mode, 
5-10 
Extensibility 
as a goal, 1-l 
Extension, specifier, 


LI=19 


L1=12 
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3-7. to. 3-8, 3=i1 
extensions to the console, 
Extent, 1-2 
EXTV - Extract Field, 4-43 
EXTZV - Extract Zero Extended 

Field, 4-43 


11-18 


F floating, 2-3 
F floating data type, operand, 
3-2 
Fault, 6-1 to 6-2 
memory management, 
Faults 
arithmetic, 6-9 
FF - Floating Fault Enable, 
FFC - Find First Clear, 4-44 
FFS - Find First Set, 4-44 
Field, 2-6 
FIELD - field addressing 
notation, 4-40 
Field instructions, 
Fill, 4-198 
Fill character, 4-198 
Fill register, 4-198 
FIND command, 11-10, 
First part done, 2-15 
flag, bootstrap in progress, 
a 
flags initialization, 
Floating, 2-4 to 2-5 
Floating currency symbol, 4-198 
Floating data type, 2-3 
Floating divide by zero fault, 
6-11 
Floating divide by zero trap, 
6-10 
Floating 


o=21 


Z2=15 


4-40 


Lids 


11-6 


fault, 2-15 
Floating overflow fault, 
Floating overflow trap, 
Floating point 
immediate constant, 3-ll 
Floating point instructions, 
4-113 
Floating sign, 4-198 
Floating underflow, 2-15 
Floating underflow fault, 6-11 
Floating underflow trap, 6-10 
FP - Current Frame Pointer 
Register, 2-13 
FPD - First Part Done, 2-15 
Frame Pointer Register, Current, 
2-13 
front panel switches, 11-7 


6-10 
6-10 
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FU - Floating Underflow Enable, ICR - Interval Count Register, 
2-15 9-10 
ICR initialization, 11-6 
G floating, 2-5 identifier, address space, 11-13 
G floating data type, Immediate addressing mode, 3-5 
operand, 3-2 Immediate constant 
General mode addressing, 3-4 floating point, 3-11 
General Purpose Registers, 2-13 integer, 3-9 
general register Immediate indexed 
address space qualifier, addressing mode, 3-12 
11-12 Immediate indexed mode, 3-12 
general register symbolic address, Immediate mode, 3-5 
11-11 INCB - Increment Byte, 4-24 
General Registers, 7-4 INCL - Increment Long, 4-24 
general registers inconsistent system state, 11-8 
during bootstrap, 11-2 INCW - Increment Word, 4-24 
general registers initialization, INDEX - Compute Index, 4-81 
11-6 Index addressing mode, 3-11 
Global page table index (gptx), Index mode, 3-11 
5-8 Index register, 2-13 
Goals, 1-1 indirect command (@ command), 
Gptx, 5-8 11-17 
indirect symbolic address, 11-11 
H floating, 2-5 Indivisible operation 
H floating data type, modify access, 3-16 
operand, 3-2 initialization, 11-5, 11-16 
halt, ll-1l, 11-3, 11-8 INITIALIZE command, 11-9, 11-13 
HALT - Halt, 4-80 Initiate exception or interrupt, 
halt action switch, 11-4, 11-7 6-27 
halt and halt messages, 11-20 INSQHI - Insert Entry into Queue 
halt code, 11-20 at Head, Interlocked, 4-98 
halt code initialization, 11-6 INSQTI - Insert Entry into Queue 
HALT command, 11-8 to 11-9, at Tail, Interlocked, 4-101 
11-14 INSQUE - Insert Entry in Queue, 
halt during command file, 11-18 4-103 
halt from control-P, 11-8 instruction buffer initialization, 
halt with console locked, 11-7 11-5 
Halt, processor, 6-18 to 6-19, Instruction emulation, B-4 
6-24, 6-28, 6-32, 6-34, 8-5 Instruction format, 3-1 
VAX-11/780, 6-20 Instruction operand formats, A-1 
halt, system, 11-8 INSV - Insert Field, 4-46 
hardware initialization, 11-5, Integer 
11-16 immediate constant, 3-9 
hexadecimal, 11-9 Integer data type, 2-1 to 2-3 
Integer divide by zero trap, 6-9 
I/O initialization, 11-5 Integer instructions, 4-6 
I/O instructions, A-19 Integer overflow, 2-15 
I/O structure, 8-7 Integer overflow trap, 6-9 
IB initialization, 11-5 Internal Processor Register, 
ICCS - Interval Clock 2-17 
Control/Status register, Internal processor register 
9-10 address space qualifier, 


ICCS initialization, 11-5 11-12 


Interrupt, 6-1 to 6-4 

Interrupt AST Delivery, 7-7 

Interrupt priority level, 2-15 

Interrupt Priority Level (IPL), 
6-1, 6-6 

Interrupt process, 6-4 

Interrupt stack, 2-15 

Interrupt stack not valid halt, 
6-18 

Interrupt, Process Scheduling, 
7-7 

Interrupts, 8-6 

Interrupts, Process Structure, 
W feos | 

Interval clock, 9-9 

Interval Clock Control/Status 

register (ICCS), 9-10 

Interval Count Register (ICR), 
9-10 

interval timer initialization, 
11-6 

IPL - Interrupt Priority Level, 
2-15, 6-2, 6-6 

IPL initialization, 11-5 

IS - Interrupt Stack in use, 
2-15, 6=25 

ISP initialization, 11-5 

IV - Integer Overflow Enable, 
2-15 


JMP - Jump, 4-63 
JSB - Jump To Subroutine, 4-64 


Kernel instruction set, B-l 

Kernel memory access mode, 5-10 

Kernel stack not valid abort, 
6-17 

keywords in console commands, 
11-9 

KSP - Kernel Stack Pointer, 7-4 

KSP initialization, 11-5 


LDPCTX - Load Process Context, 
7-8 

LDPCTX -- Load Process Context, 
4-218 

Leading separate sign, 4-169, 
4-183, 4-187 

Leading zero, 4-216 

length, maximum command, 11-9 

lights and switches, 11-8 

Literal addressing mode, 3-9 

Literal mode, 3-9 
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LOAD command, 11-10, 11-14 
load command (X command), 11-16 
LOCC, B-2 
LOCC - Locate Character, 4-148. 
Logical instructions, 4-6 
Longword, 2-2 
Longword data type, operand, 3-2 
Longword displacement 
addressing mode, 3-7 
Longword displacement deferred 
addressing mode, 3-8 
indexed addressing mode, 
3-12 
indexed mode, 3-12 
mode, 3-8 
Longword displacement indexed 
addressing mode, 3-12 
mode, 3-12 
Longword displacement mode, 3-7 
longword qualifier, 11-12 
lower case, 11-9 


M - Modify bit, 5-6 
Machine check exception, 6-18 
MAPEN - Map Enable Register, 5-5 
MAPEN initialization, 11-5 
MATCHC, B-2 
MATCHC - Match Characters, 4-150 
MBZ, 1-2 
MBZ, inconsistent state, 11-8 
MCOMB - Move Complemented Byte, 
4-25 
MCOML - Move Complemented Long, 
4-25 
MCOMW - Move Complemented Word, 
4-25 
Memory access mode, 2-15, 5-10 
Executive, 5-10 
Kernel, 5-10 
Supervisor, 5-10 
User, 5-10 
memory initialization, 11-6 
Memory management control, 5-5 
Memory management exceptions, 
6-11 
Memory management faults, 5-21 
Memory Mapping Enable (MAPEN), 
5=5 


memory, searching for 64K of good, 


11-13 
MFPR - Move From 
Processor Register, 9-4 
MFPR -- Move From Processor 


Register, 4-218 
micro PC, 11-14 
microcode 
address space qualifier, 
11-12 
microinstruction, 11-14 
microprocessor, 11-8 
address space qualifier, 
Lit 12 
MICROSTEP command, 11-9, 11-14 
Microvax subset, B-3 to B-4 
MINU - minimum unsigned notation, 
4-5 
Miscellaneous instructions, 4-76 
MME - Memory Mapping Enable, 5-5 


MNEGB - Move Negated Byte, 4-26 

MNEGD, B-2 

MNEGD - Move Negated D floating, 
4-130 

MNEGF, B-2 

MNEGF - Move Negated F floating, 
4-130 

MNEGG, B-2 

MNEGG - Move Negated G floating, 
4-130 

MNEGH, B-2 

MNEGH - Move Negated H floating, 
4-130 

MNEGL - Move Negated Long, 4-26 

MNEGW - Move Negated Word, 4-26 

Mode, 2-15, 5-10 


compatibility, 2-15 
Mode changing instructions, 6-32 
Mode, memory access, 2-15, 5-10 
Modify access type, operand, 
3-2; 2215 
synchronization, 3-16 
Modify bit, 5-6 


MOVAB - Move Address Byte, 4-38 

MOVAD - Move Address D floating, 
4-38 

MOVAF - Move Address F floating, 
4-38 

MOVAG - Move Address G floating, 
4-38 

MOVAH, B-2 

MOVAH - Move Address H floating, 
4-38 

MOVAL - Move Address Long, 4-38 

MOVAO, B-2 

MOVAO - Move Address Octa, 4-38 

MOVAQ - Move Address Quad, 4-38 

MOVAW - Move Address Word, 4-38 
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MOVB - Move Byte, 4-27 

MOVC3, B-2 

MOVC3 - Move Character 3 Operand, 
4-152 

MOVC5, B-2 

MOVC5 - Move Character 5 Operand, 
4-152 

MOVD, B-2 

MOVD - Move D floating, 4-131 

MOVF, B-2 7 

MOVF - Move F floating, 4-131 

MOVG, B-2 

MOVG - Move G floating, 4-131 

MOVH, B-2 

MOVH - Move H floating, 4-131 

MOVL - Move Long, 4-27 

MOVO, B-2 

MOVO - Move Octa, 4-27 

MOVP, B-2 

MOVP - Move Packed, 4-193 


MOVPSL - Move PSL, 4-83 

MOVO - Move Quad, 4-27 

MOVTC, B-2 

MOVTC - Move Translated 
Characters, 4-156 

MOVTUC, B-2 

MOVTUC - Move Translated 
Until Character, 4-159 

MOVW - Move Word, 4-27 

MOVZBL - Move Zero-Extended 
Byte to Long, 4-28 

MOVZBW - Move Zero-Extended 
Byte to Word, 4-28 

MOVZWL - Move Zero-Extended 
Word to Long, 4-28 

MTPR - Move To 
Processor Register, 9-3 

MTPR -- Move To Processor 
Register, 4-218 

MULB2 - Multiply Byte 2 Operand, 

4-29 
MULB3 - Multiply Byte 3 Operand, 
4-29 

MULD2, B-2 

MULD2 - Multiply D floating 
2 Operand, 4-132 

MULD3, B-2 

MULD3 - Multiply D floating 
3 Operand, 4-132 

MULF2, B-2 

MULF2 - Multiply F_ floating 
2 Operand, 4-132 

MULF3, B-2 


MULF3 - Multiply F floating 
3 Operand, 4-132 
MULG2, B-2 
MULG2 - Multiply G floating 
2 Operand, 4-132 
MULG3, B-2 
MULG3 - Multiply G floating 
3 Operand, 4-132 
MULH2, B-2 
MULH2 - Multiply H floating 
2 Operand, 4-132 
MULH3, B-2 
MULH3 - Multiply H_ floating 
3 Operand, 4-132 
MULL2 - Multiply Long 2 Operand, 
4-29 
MULL3 - Multiply Long 3 Operand, 
4-29 
MULP, B-2 
MULP - Multiply Packed, 4-194 
MULW2 - Multiply Word 2 Operand, 
4-29 
MULW3 - Multiply Word 3 Operand, 
4-29 


N —- Negative Condition Code, 
2-15 
N condition code, 2-15 
next (/N) qualifier, 11-12 
NEXT command, 11-9, 11-15 
Next Interval Count 
Register (NICR), 9-10 
Nibble, 2-12 
NICR - Next Interval Count 
Register, 9-10 
NICR initialization, 11-6 
NOP - No Operation, 4-84 
Notation 
(), 3-3 
{}, 323 
addressing modes, 3-3 
FIELD - field addressing, 4-40 
MINU - minimum unsigned, 4-5 
OA - operand address, 3-3 
operand specifier, 4-2, A-10 
operation description, 4-4 
Rin], 2-13 
register, 2-13 
REM - remainder, 4-5 
Rn, 2-13 
SEXT - sign extend, 3-3, 4- 
ZEXT - zero extend, 3-3, 4- 
Numbering, 1-2 


ts) 
<) 
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numbers in console commands, 
11-9 


OA - operand address notation, 
3=3 
octal, 11-9 
Octaword, 2-3 
Octaword data type, operand, 3-2 
Opcode assignments, A-13 
Opcode formats, 3-l 
Opcode reserved to customers 
fault, 6-13 
Opcode reserved to DIGITAL Fault, 
6-13 
Operand format summary, A-l 
Operand specifier, 3-2 
Operand specifier access type, 
3-2 
Operand specifier conventions, 
3-15 
Operand specifier data type, 3-2 
Operand specifier notation, A-10 
Operand specifier, base, 3-12 
Operand, primary, 3-11 
operator console terminal, 11-8 
optional console features, 11-19 
options, 11-18 
Orthogonality 
as a goal, 1-l 
Overflow, 2-15, 6-3, 
6-9 to 6-10, 6-18 
stack, 6-17 


P (control-P), 11-8 

PQ Base Register, 7-4 

PO Base Register (POBR), 5-15 

PO Length Register (POLR), 5-15 

PQ Limit Register, 7-4 

PO Page Table (POPT), 5-15 

PO Region, 5-15 

PQ region, 5-4 

POBR - PO Base Register, 5-15, 
7-4 

POBR initialization, 11-5 

POLR - PO Length Register, 5-15 

POLR - PO Limit Register, 7-4 

POLR initialization, 11-5 

POPT - PQ Page Table, 5-15 

Pl Base Register, 7-5 

Pl Base Register (P1BR), 5-18 

Pl Length Register (P1LR), 5-18 

Pl Limit Register, 7-5 

Pl Page Table (P1PT), 5-18 


Pl Region, 5-18 
Pl region, 5-4 
P1BR - Pl Base Register, 5-18, 
7-5 
P1IBR initialization, 11-5 
PILR - Pl Length Register, 5-18 
PILR - Pl Limit Register, 7-5 
PILR initialization, 11-5 
PIPT - Pl Page Table, 5-18 
Packed decimal 
instructions, 4-169 
Packed decimal string, 2-12 
Page, 5-2 
Page frame number field, 
Page Table Entry (PTE), 
5-6 to! 5-7 
Parentheses 
as a notation, 
Part done, 2-15 
PC - Program Counter Register, 
2-13 
in process context, 7-4 
PC symbolic address, 11-11 
PCB - Process Control Block, 
PCBB - Process Control Block 
Base, /-l 
PCBB initialization, 11-5 
PDP-11 Compatibility Mode, B-2 
Per-process Space, 5-4 
Performance monitor enable, 7-5 
peripheral initialization, 11-5 
PFN - Page Frame Number field, 
5-6 
physical memory qualifier, 11-12 
PME - Performance Monitor Enable, 
7-5 
PME initialization, 
POLYD, B-2 
POLYD - Polynomial Evaluation 
D floating, 4-134 
POLYF, B-2 
POLYF - Polynomial Evaluation 
F floating, 4-134 
POLYG, B-2 
POLYG - Polynomial Evaluation 
G floating, 4-134 
POLYH, B-2 
POLYH - Polynomial Evaluation 
H floating, 4-134 
POPR - Pop Registers, 4-85 
Power fail, 8-5 
powered off, 11-1 
powerfail, 11-4, 11-7 


5-6 


5-3 


7-2 


11-5 
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powerfail recovery, 11-1, 
11-3 to 11-4, 11-7 to 11-8 
Previous mode, 2-15 
Primary operand, 3-11 
Priority level, 2-15 
Probe accessibility, 
PROBER - Probe Read 
Accessibility, 4-218 
accessibility, 5-23 
PROBEW - Probe Write 
Accessibility, 4-218 
accessibility, 5-23 
Procedure call instructions, 
4-68 
Procedure calling interface, 
4-68 
Process context, 7-l 
Process control block, 
Process scheduling, 7-1 


57-23%. -9=29 


1-2 


Process Space, 5-4, 5-15 
Process, definition, 7-1 
Processor Errors, 8-7 


processor initialization, 11-5, 
11-10 to 11-11 

Processor Internal Register 

Space, 9-1 

Processor mode, 5-10 

Processor option, B-l 

Processor Registers, 9-5 

processor running, 11-1 

processor status longword, 11-1ll 

Processor Status Longword (PSL), 
2-14, 6-4 

Processor Status Word, 

Processor type, 9-6 

Program counter 
in process context, 7-4 

Program Counter Register, 2-13 

program counter symbolic address, 
11-11 

program I/O mode, 
11-10 

Program status longword 
in process context, 7-4 


2-14 


Lim L; “bls, 


PROT - Protection field, 5-6 
Protection, 5-10 

check, 4-213 
Protection Code, 5-10 
Protection field, 5-6 
PRV MOD - Previous Mode, 2-15 


PSL, 11-11 
PSL - Processor Status Longword, 
2-14, 6-4 


Page Index-14 


PSL - Program Status Longword Register usage, 2-13 
in process context, 7-4 register, symbolic address of, 
PSL initialization, 11-5 11-11 
PSL<CM>, 11-12 Registers 
PSW - Processor Status Word, General Purpose, 2-13 
2-14, 6-2, 6-4, 6-12 Internal Processor, 2-17 
PTE - Page Table Entry, VAX Series, 9-5 
5-6 to 5-7 VAX-11/730 Specific, 9-12 
PTE<M>, 11-12 VAX-11/750 Specific, 9-12 
PUSHAB - Push Address Byte, 4-39 VAX-11/780 Specific, 9-11 
PUSHAD - Push Address D floating, REI - Return from Exception 
4-39 or Interrupt, 6-30 
PUSHAF - Push Address F floating, REI -- Return from Exception 
4-39 or Interrupt, 4-218 
PUSHAG - Push Address G floating, REM - remainder notation, 4-5 
4-39 REMQHI - Remove Entry from Queue 
PUSHAH, B-2 at Head, Interlocked, 4-105 
PUSHAH - Push Address H floating, REMQTI - Remove Entry from Queue 
4-39 at Tail, Interlocked, 4-108 
PUSHAL - Push Address Long, 4-39 REMQUE - Remove Entry from Queue, 
PUSHAO, B-2 4-llil 
PUSHAO - Push Address Octaword, REPEAT command, 11-10, 11-15 
4-39 RESERVED, 1-3 
PUSHAQ - Push Address Quad, 4-39 Reserved addressing mode fault, 
PUSHAW - Push Address Word, 4-39 6-11 
PUSHL - Push Long, 4-30 Reserved operand exception, 6-12 
PUSHR - Push Registers, 4-86 restart address, 11-3 
restart algorithm, 11-3 
Quadword, 2-2 restart in progress flag 
Quadword data type, operand, 3-2 initialization, 11-6 
qualifiers, console command, restart of system, 11-1 
11-9 Restart Parameter Block, ll-l, 
Queue instructions, 4-89 11-3 to 11-4, 11-13 
Restartability, 8-6 
radix, 11-9 RET - Return from Procedure, 
Range 4-74 
as a goal, 1-1 Revision level, 9-6 
Range of values, 1-2 Rn, 11-11 
Read access type, operand, 3-2, ROTL - Rotate Long, 4-31 
3-15 RPB, 11-1, 11-3 to 11-4, 11-13 
Register RSB - Return From Subroutine, 
fill, 4-198 4-65 
Sign, 4-198 running system, 11-1 
Register addressing mode, 3-4 RXCS - Console Receive 
Register deferred Control/Status register, 9-7 
addressing mode, 3-4 RXCS initialization, 11-5 
Register deferred indexed RXDB - Console Receive 
addressing mode, 3-12 Data Buffer register, 9-7 
Register deferred indexed mode, 
3-12 Saved PC, 6-2 to 6-3, 6-9, 
Register deferred mode, 3-4 6-12, 6-14 to 6-15, 
register initialization, 11-6 6-18 to 6-19 


Register mode, 3-4 Saved PSL, 2-14, 6-3 to 6-4, 


6-9, 6-14 to 6-15, 

6-17 to 6-19 
Saved TP, 6-14 to 6-15, 

6-17 to 6-19 
SBR - System Base Register, 5-12 
SBR initialization, 11-5 
SBWC - Subtract With Carry, 4-32 
SCANC, B-2 
SCANC - Scan Characters, 4-161 


SCBB - System Control Block Base, 


6-20 
SCBB initialization, 11-6 
Scheduling, process, 7-1 
self test command, 11-16 
Self-relative queues, 4-94 
Separate sign, leading, 4-169, 
4-183, 4-187 


Separation of procedure and data, 


8-2 
Serial number, 9-6 
Serialization of notification 
of multiple events, 6-18 
SET command, 11-10, 11-16 
SEXT - sign extend notation, 
3-3, 4-5 
Sharing, 8-1 
SID - System Identification, 9-6 
Sign, 4-198 
currency, 4-198 
Sign character, 4-198 
Sign register, 4-198 
Significance, 4-198 
Significance indicator, 4-198, 
4-216 
Significant digits, 4-198 
Single step, 11-14 to 11-15 
SIRR - Software Interrupt 
Request Register, 6-1, 6-4, 
6-6 
SISR - Software Interrupt 
Summary Register, 6-5 to 6-6 
SISR initialization, 11-5 
SKPC, B-2 
SKPC - Skip Character, 4-163 
SLR - System Length Register, 
5-12 
SLR initialization, 11-5 
SOBGEQ - Subtract One and Branch 
Greater Than or Equal, 4-66 
SOBGTR - Subtract One and Branch 
Greater Than, 4-67 
software done message, 11-18 
Software Interrupt 
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Request Register (SIRR), 6- 
Summary Register (SISR), 6- 
Software interrupt, 6-5 
SP, l1l-ll 
SP - Stack Pointer Register, 
2-13 
space bar step mode, 
11-14 to 11-15 
spaces and tabs in commands, 
11-9 
SPANC, B-2 
SPANC - Span Characters, 4-165 
Specifier extension, 
3-7 to 3-8, 3-11 
SPT - System Page Table, 5-12 
SSP - Supervisor Stack Pointer, 
7-4 
SSP initialization, 11-5 
Stack alignment, 6-25 
Stack frame, 4-68 
Stack pointer 
in process context, 7-4 
Stack pointer, 11-11 
Stack pointer images, 9-2 
Stack Pointer Register, 2-13 
stack pointers initialization, 
11-5 
Stack residency, 6-24 
Stack, switch, 6-24, 6-27, 6-30 
START command, 11-8 to 11-9, 
11-15 
Starting address qualifier, 
11-14 
state transitions, 11-6 to 11-7 
State, inconsistent system, 11-8 
states, major system, 11-1 
String data type 
character, 2-7 
packed decimal, 2-12 
String descriptor 
as operand, 4-142, 4-169 
String instructions 
Character, 4-142 
cyclic redundancy check, 4-167 
decimal, 4-169 
SUBB2 - Subtract Byte 2 Operand, 
4-33 
SUBB3 - Subtract Byte 3 Operand, 
4-33 
SUBD2, B-2 
SUBD2 - Subtract D floating 
2 Operand, 4-139 
SUBD3, B-2 


6 
3 


SUBD3 - Subtract D_ floating 
3 Operand, 4-139 
SUBF2, B-2 
SUBF2 - Subtract F_ floating 
2 Operand, 4-139 
SUBF3, B-2 
SUBF3 - Subtract F floating 
3 Operand, 4-139 
SUBG2, B-2 
SUBG2 - Subtract G floating 
2 Operand, 4-139 
SUBG3, B-2 
SUBG3 - Subtract G floating 
3 Operand, 4-139 
SUBH2, B-2 
SUBH2 - Subtract H floating 
2 Operand, 4-139 
SUBH3, B-2 
SUBH3 - Subtract H floating 
3 Operand, 4-139 
SUBL2 - Subtract Long 2 Operand, 
4-33 
SUBL3 - Subtract Long 3 Operand, 
4-33 
SUBP4, B-2 
SUBP4 - Subtract Packed 
4 Operand, 4-196 
SUBP6, B-2 
SUBP6 - Subtract Packed 
6 Operand, 4-196 
Subscript range trap, 6-10 
subset console, 11-18 
Subsettable instructions, B-l 
SUBW2 - Subtract Word 2 Operand, 
4-33 
SUBW3 - Subtract Word 3 Operand, 
4-33 
Summary, 1-l 
Supervisor memory access mode, 
5-10 
SVPCTXK - Save Process Context, 
7-10 
SVPCTX -- Save Process Context, 
4-218 
Switching, context, 7-1 
symbolic addresses, 11-11 
Synchronization, 8-1 
modify access, 3-16 
System Base Register (SBR), 5-12 
system bootstrap, 11-1, 11-8, 
11-10 
system bus initialization, 11-5 


System Control Block Base (SCBB), 


Page Index-16 


6-20 
system error, 11-8 
system halt, 11-1, 11-8 
System Identification 
register (SID), 9-6 
system initialization, 11-16 
System Length Register (SLR), 
5-12 
System Page Table (SPT), 5-12 
system powered off, 11-1 
system powerfail and recovery, 
11-4 
System Region, 5-12 
system restart, ll-1, 11-3, 11-7 
system restart algorithm, 11-3 
System restart, failure, 11-8 
system running, ll-1l 
System Space, 5-4, 5-12 
system state transitions, 
11-6 to 11-7 
system states, ll-l 


T - Trace Enable, 2-15 
tabs and spaces in commands, 
11-9 
TB initialization, 11-6 
TBCHK - Translation Buffer 
Check register, 5-21 
TBIA - Translation Buffer 
Invalidate All Register, 
5-21 
TBIS - Translation Buffer 
Invalidate Single Register, 
5-21 
Terminology 
general, 1-2 
TEST command, 11-10, 11-16 
time of day clock initialization, 
11-6 
Time-of-Year Register (TODR), 
9-8 
timer, initialization, 11-6 
TODR - Time-of-Year Register, 
9-8 
TODR initialization, 11-6 
TP - Trace Pending, 2-15 
Trace, 2-15, 6-14 
Trace pending, 2-15 
Trailing numeric 
string instructions, 4-169 
string instructions, 4-185, 
4-189 
transitions, major system state, 


lil-1, 11-6 to 11-7 
Translation buffer, 5-20 
Translation Buffer Check 

register (TBCHK), 5-21 


translation buffer initialization, 


11-6 
Translation Buffer Invalidate 
All Register (TBIA), 5-21 
Single Register (TBIS), 5-21 
Translation not valid fault, 
6-11 


translation of virtual addresses, 


11-13 
Translation, address, 5-6 
Trap, 6-1 to 6-2 
Traps 
arithmetic, 6-9 

TSTB - Test Byte, 4-34 
TSTD, B-2 
TSTD - Test D floating, 4-141 
TSTF, B-2 
TSTF - Test F floating, 4-141 
TSTG, B-2 
TSTG - Test G floating, 4-141 
TSTH, B-2 
TSTH - Test H floating, 4-141 
TSTL - Test Long, 4-34 
TSTW - Test Word, 4-34 
TXCS - Console Transmit 

Control/Status register, 9-8 
TXCS initialization, 11-5 
TXDB - Console Transmit 

Data Buffer register, 9-8 
Type, processor, 9-6 


UNDEFINED, 1-2 

UNDEFINED processor operation, 
11-5, 11-8 

UNIBUS, 6-1, 6-5 

UNJAM command, 11-9, 11-16 

unload command (X command), 
11-16 

Unmapped system, 5-5 

UNPREDICTABLE, 1-2 


control characters to console, 


11-9 

UNPREDICTABLE results, 11-13, 

11-17 
Unsigned integer, 2-1 to 2-2 
uPC, 11-14 
upper case, 11-9 
User memory access mode, 5-10 
USP - User Stack Pointer, 7-4 
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USP initialization, 11-5 


V - Overflow Condition Code, 
2-15 

V - Valid bit, 5-6 

V condition code, 2-15 

Valid bit, 5-6 

Validating address arguments, 
5-22 

Variable length bit field 

instructions, 4-40 

bytes referenced, 2-6 
data type, 2-6 

Vector, 6-2, 6-13 to 6-14, 
6-17 to 6-18, 6-20 to 6-21, 
6-24 to 6-25, 6-27, 6-33 
interrupt, 6-4 

Virtual address, 2-l 

Virtual Address Space, 5-2 

virtual address translation, 
11-13 

virtual memory qualifier, 11-12 

Virtual Page Number, 5-4 

VMB, 11-1 to 11-2, 11-10 

VPN - Virtual Page Number, 5-4 


Word, 2-2 
Word data type, operand, 3-2 
Word displacement 
addressing mode, 3-7 
Word displacement deferred 
addressing mode, 3-8 
indexed addressing mode, 
3-12 
indexed mode, 3-12 
Word displacement deferred mode, 
3-8 
Word displacement indexed 
addressing mode, 3-12 
Word displacement indexed mode, 
3-12 
Word displacement mode, 3-7 
word qualifier, 11-12 
Write access type, operand, 
3=2,: 3-15 


X command, 11-10, 11-16 
XFC - Extended Function Call, 
4-87 
XORB2 - Exclusive OR Byte 
2 Operand, 4-35 
XORB3 - ExcluSive OR Byte 
3 Operand, 4-35 


XORL2 - Exclusive OR Long 
2 Operand, 4-35 

XORL3 - Exclusive OR Long 
3 Operand, 4-35 

XORW2 - Exclusive OR Word 
2 Operand, 4-35 

XORW3 - Exclusive OR Word 
3 Operand, 4-35 


Z—- Zero Condition Code, 2-15 
Z condition code, 2-15 
Zero 
leading, 4-216 
ZEXT - zero extend notation, 
3-3, 4-5 
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